CVE-2026-13242: SQL Injection Vulnerability in Drupal Geolocation Module
Summary
CVE-2026-13242: Geolocation modules adds a field to store coordinates and provides supporting plumbing for views and other modules. Affects drupal/geolocation versions < 3.15.0. Fixed in 3.15.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Drupal Geolocation module enhances Drupal's capabilities by adding a field to store geographical coordinates. It supports various functionalities, including integration with views and other modules, allowing developers to create location-based features. However, the module's reliance on user input for certain views filters has exposed it to security risks, particularly SQL injection vulnerabilities.
Vulnerability Detail
The vulnerability arises from insufficient sanitization of user input in one of the views filters provided by the Geolocation module. If a view is configured to use this filter and accepts user input, an attacker could exploit this weakness to execute arbitrary SQL queries against the database. This could lead to unauthorized data access, data manipulation, or even complete database compromise, depending on the attacker's intent and the database's configuration.
How To Fix
Minimum fixed version
3.15.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the affected views filter that allows user input until you can update the module. This will prevent any potential exploitation of the vulnerability while you prepare for the update.
Conclusion
The SQL injection vulnerability in the Drupal Geolocation module poses a significant risk to applications that utilize this module with user input. It is crucial to update to the latest version to safeguard against potential attacks. Additionally, using tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for drupal/geolocation →
FAQ
The vulnerability could allow attackers to execute arbitrary SQL queries, potentially leading to unauthorized access or manipulation of the database.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Yes, the vulnerability is patched in version 3.15.0 of the Geolocation module. Updating to this version will resolve the issue.
As a temporary measure, disable the views filter that accepts user input to mitigate the risk of exploitation.
You can reach out to Michael Maturi, who reported the vulnerability, through their Drupal profile at https://www.drupal.org/u/michaelmaturi.
