Executive brief
The Geolocation Field module for Drupal, which allows websites to store and display geographic coordinates, contains a critical security flaw. A vulnerability in how the module handles map filters could allow an attacker to execute unauthorized database commands. If exploited, this could lead to the theft of sensitive data, modification of site content, or a complete takeover of the website's database.
Technical details
A SQL injection vulnerability exists in the Drupal Geolocation Field module due to improper neutralization of special elements within one of its provided Views filters. The root cause is a failure to sufficiently sanitize user-supplied input when a View is configured to expose this specific filter to the public. An unauthenticated remote attacker can exploit this by submitting crafted input to the affected filter, leading to unauthorized database queries. The vulnerability is mitigated by the requirement that a View must be actively using the vulnerable filter and have it configured to accept user input. The issue is resolved in version 8.x-3.15 and 4.0.0.
Affected products
- Drupal Geolocation Field 0.0.0 to 3.14.x (less than 3.15.0)
Timeline
- 2026-06-21: patched: Version 8.x-3.15 and 4.0.0 released
- 2026-06-24: advisory: Drupal security advisory SA-CONTRIB-2026-062 published
- 2026-07-10: disclosed: NVD publication date