CVE-2018-7602: Drupal Core Remote Code Execution Vulnerability

drupal/core Updated 02 Oct 2025

Summary

23/04/2024

Disclosed on

CVE-2018-7602

CVE

Yes i

Fix available

Critical

Severity

9.8

CVSS Score

CVE-2018-7602: Drupal Core Remote Code Execution Vulnerability. Affects drupal/core across 3 version ranges.

>= 7.0, < 7.59 >= 8.0, < 8.4.8 >= 8.5, < 8.5.3

Fixed in 7.59, 8.4.8 or 8.5.3, depending on the release line you run. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

Drupal is a popular open-source content management system (CMS) used to build websites and applications. It provides a flexible framework for developers to create and manage digital content. The vulnerability identified as CVE-2018-7602 affects Drupal versions 7.x and 8.x. This vulnerability allows attackers to execute remote code on a Drupal site, potentially compromising the entire system. The vulnerability is considered highly critical and has a CVSS score of 9.8.

Vulnerability Detail

The remote code execution vulnerability in Drupal Core (CVE-2018-7602) is a result of multiple weaknesses in the system's subsystems. Attackers can exploit these weaknesses to launch various attack vectors on a Drupal site, leading to potential compromise. The vulnerability is related to SA-CORE-2018-002, which is also being actively exploited in the wild. It is crucial for Drupal site owners to address this vulnerability promptly to prevent unauthorized access and potential data breaches.

How To Fix

Fixed versions by release line

The minimum fixed version depends on the release line you run.

>= 7.0, < 7.59 7.59
```
composer require drupal/core:7.59
```
>= 8.0, < 8.4.8 8.4.8
```
composer require drupal/core:8.4.8
```
>= 8.5, < 8.5.3 8.5.3
```
composer require drupal/core:8.5.3
```

Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →

Workaround

There is no specific workaround provided for this vulnerability. Upgrading to the patched versions is the recommended solution.

Conclusion

The CVE-2018-7602 vulnerability in Drupal Core is highly critical and can lead to remote code execution on affected sites. It is essential for Drupal site owners to upgrade their installations to the recommended patched versions to mitigate the risk of unauthorized access and potential data breaches. For further support and assistance in vulnerability remediation, you can contact DevNack.com.

See every vulnerability recorded for drupal/core →