CVE-2026-9082: Drupal Core SQL Injection Vulnerability
Summary
CVE-2026-9082: Drupal Core has a SQL Injection issue. Affects drupal/core across 6 version ranges.
>= 8.9.0, < 10.4.10
>= 10.5.0, < 10.5.10
>= 10.6.0, < 10.6.9
>= 11.0.0, < 11.1.10
>= 11.2.0, < 11.2.12
>= 11.3.0, < 11.3.10
Fixed in 6 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- drupal · Bitnami
The same CVE-2026-9082 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal is a popular open-source content management system (CMS) that allows users to create and manage websites easily. It is known for its flexibility, scalability, and a large ecosystem of modules and themes. However, like any software, it can be vulnerable to security issues. The SQL Injection vulnerability in Drupal Core allows attackers to manipulate SQL queries, potentially leading to unauthorized access to sensitive data.
Vulnerability Detail
The vulnerability arises from improper neutralization of special elements used in SQL commands, allowing attackers to execute arbitrary SQL code. This can lead to data breaches, unauthorized data manipulation, and other malicious activities. The affected versions of Drupal Core include those from 8.9.0 before 10.4.10, 10.5.0 before 10.5.10, 10.6.0 before 10.6.9, 11.0.0 before 11.1.10, 11.2.0 before 11.2.12, and 11.3.0 before 11.3.10. The severity of this vulnerability is rated as critical, with a CVSS score of 9.8, indicating a high risk to affected systems.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 8.9.0, < 10.4.1010.4.10composer require drupal/core:10.4.10 -
>= 10.5.0, < 10.5.1010.5.10composer require drupal/core:10.5.10 -
>= 10.6.0, < 10.6.910.6.9composer require drupal/core:10.6.9 -
>= 11.0.0, < 11.1.1011.1.10composer require drupal/core:11.1.10 -
>= 11.2.0, < 11.2.1211.2.12composer require drupal/core:11.2.12 -
>= 11.3.0, < 11.3.1011.3.10composer require drupal/core:11.3.10
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate patching is not possible, consider restricting database access and implementing web application firewalls to mitigate the risk of SQL injection attacks. Additionally, validate and sanitize user inputs to prevent malicious SQL code from being executed.
Conclusion
The SQL Injection vulnerability in Drupal Core poses a significant risk to affected systems, allowing attackers to execute arbitrary SQL commands. It is crucial for users to update their Drupal installations to the patched versions to mitigate this risk. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for drupal/core →
FAQ
SQL Injection is a type of security vulnerability that allows an attacker to interfere with the queries that an application makes to its database.
You can check your current Drupal version and compare it with the affected versions listed in the vulnerability report. Additionally, you can use Vulert to monitor and alert for vulnerabilities.
Implement workarounds such as restricting database access and validating user inputs until you can apply the necessary updates.
Vulert uses the composer.lock file to monitor and alert in real-time for open-source vulnerabilities in your software without requiring access to the code or installation.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for drupal/core.
