Executive brief
The Drupal AlternativeCommerce (Basket) module, which provides e-commerce and checkout functionality for Drupal websites, contains a critical security flaw. An attacker can exploit this vulnerability to execute unauthorized code on the server, potentially leading to a full site takeover, theft of customer data, or service disruption. Users are strongly advised to update to the latest version immediately to protect their online stores.
Technical details
The Basket module for Drupal fails to sufficiently sanitize user-supplied data before passing it to the PHP unserialize() function, leading to a PHP Object Injection vulnerability (CWE-915/CWE-502). An unauthenticated remote attacker can provide a specially crafted payload that, when processed, can leverage existing gadget chains within the site's codebase or its dependencies. Successful exploitation allows for arbitrary PHP code execution on the underlying server. The vulnerability is addressed in version 2.1.17 by implementing proper data handling.
Affected products
- Drupal Drupal AlternativeCommerce (Basket) 0.0.0 to 2.1.16
Timeline
- 2026-05-27: advisory: Initial security advisory SA-CONTRIB-2026-038 released by Drupal Security Team
- 2026-05-27: patched: Version 2.1.17 released to address the vulnerability
- 2026-07-10: disclosed: CVE-2026-9726 published to the NVD dataset