Drupal Cloud Command Injection and Cert Flaws

OS command injection (CWE-78) in the Drupal 'Cloud' contributed module affects versions 0.0.0 through 7.0.1 and allows an authenticated, low-privileged user to execute arbitrary OS commands, with high impact on confidentiality and integrity and no assessed availability impact. Exploitation requires user interaction and high attack complexity, so successful attacks depend on conditions beyond the attacker's direct control; the module is not part of Drupal core, so sites that do not run it are unaffected. EPSS is low (0.63%, 50th percentile), no CISA KEV listing or public exploit was identified at time of analysis, and the vendor has released a fixed version (7.0.1).

Improper certificate validation in the Drupal Cloud module (versions 0.0.0 through 7.0.1, fixed in 7.0.1) lets an attacker who already occupies an adversary-in-the-middle position on the network path have a forged or untrusted certificate accepted, yielding limited confidentiality and integrity impact without authentication or user interaction (CVSS 4.8, AC:H, PR:N, UI:N). The MitM prerequisite is the main limiting factor: an off-path remote attacker cannot trigger the flaw. No public exploit has been identified at time of analysis, the issue is not in CISA KEV, and EPSS is low at 0.09% (percentile 0%), so it is rated a moderate-severity, lower-priority item scheduled for this month.