Executive brief
Drupal, a widely used content management system for building websites, contains a critical security flaw that could allow an attacker to interfere with the site's database. By exploiting this vulnerability, an unauthorized individual could potentially steal sensitive user data, modify website content, or gain full control over the site. Organizations using affected versions of Drupal should update to a patched version immediately to prevent potential data breaches or service disruptions.
Technical details
A SQL injection vulnerability (CWE-89) exists in Drupal core due to improper neutralization of special elements used in SQL commands. The vulnerability allows an unauthenticated remote attacker to send specially crafted input to the application that is then incorrectly handled during database query construction. This can lead to unauthorized data disclosure, modification, or deletion within the database. The issue affects multiple major versions of Drupal core, and patches have been released for the 10.4, 10.5, 10.6, 11.1, 11.2, and 11.3 branches.
Affected products
- Drupal Drupal core >= 8.9.0, < 10.4.10; >= 10.5.0, < 10.5.10; >= 10.6.0, < 10.6.9; >= 11.0.0, < 11.1.10; >= 11.2.0, < 11.2.12; >= 11.3.0, < 11.3.10
Timeline
- 2026-05-20: disclosed
- 2026-05-20: advisory
- 2026-06-18: patched: Advisory updated with reviewed status and final patch details.