Vulnerability advisory

CVE-2026-9082

Drupal core - Highly critical - SQL injection - SA-CORE-2026-004

Published May 20, 2026Updated Oct 28, 2026OSV record ↗

Also known as BIT-drupal-2026-9082DRUPAL-CORE-2026-004GHSA-ghwc-95x2-682j

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected versions

Repository

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection.

This issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, from 11.0.0 before 11.1.10, from 11.2.0 before 11.2.12, from 11.3.0 before 11.3.10.

Affected commits	Fixed by commit
GIT git.drupalcode.org/project/drupal ↗
a412ca41cfc0d954fe3cb2dd982dc6ca049b1c70 to before b6a15bbe200725c195a01e86f058059650e24d8d	`b6a15bbe200725c195a01e86f058059650e24d8d`
d4b39f784711f3b861d59c37ec8e9f5592b623ce to before 064f2a61e4d30eb2949ec5e3ec77d8f5cecd2a87	`064f2a61e4d30eb2949ec5e3ec77d8f5cecd2a87`
920f3f7ab87ba2cca9191ec292d356197de4bc0a to before ded704bfa93b9037cb312057abab97d89746ea36	`ded704bfa93b9037cb312057abab97d89746ea36`
140f94ff1051644c4416c7ed30cc5dd1f14507b2 to before fe5b9e6d3961e05cc549b935e05f533f0fb4939b	`fe5b9e6d3961e05cc549b935e05f533f0fb4939b`
338d58439d5b59d92ac9519ad81ffd916b673841 to before ce6f20a43d1119288b51f2c452644ba7ea1fab61	`ce6f20a43d1119288b51f2c452644ba7ea1fab61`
ac5da07ad88571dbb31dfb52f055bb0d4063f598 to before 26adc3e4f17a0710db766703c0aa761cc26e0112	`26adc3e4f17a0710db766703c0aa761cc26e0112`
GIT github.com/drupal/drupal ↗
a412ca41cfc0d954fe3cb2dd982dc6ca049b1c70 to before b6a15bbe200725c195a01e86f058059650e24d8d	`b6a15bbe200725c195a01e86f058059650e24d8d`
d4b39f784711f3b861d59c37ec8e9f5592b623ce to before 064f2a61e4d30eb2949ec5e3ec77d8f5cecd2a87	`064f2a61e4d30eb2949ec5e3ec77d8f5cecd2a87`
920f3f7ab87ba2cca9191ec292d356197de4bc0a to before ded704bfa93b9037cb312057abab97d89746ea36	`ded704bfa93b9037cb312057abab97d89746ea36`
140f94ff1051644c4416c7ed30cc5dd1f14507b2 to before fe5b9e6d3961e05cc549b935e05f533f0fb4939b	`fe5b9e6d3961e05cc549b935e05f533f0fb4939b`
338d58439d5b59d92ac9519ad81ffd916b673841 to before ce6f20a43d1119288b51f2c452644ba7ea1fab61	`ce6f20a43d1119288b51f2c452644ba7ea1fab61`
ac5da07ad88571dbb31dfb52f055bb0d4063f598 to before 26adc3e4f17a0710db766703c0aa761cc26e0112	`26adc3e4f17a0710db766703c0aa761cc26e0112`
Also listed as affected (34) `10.6.8` `11.3.9` `11.3.8` `10.5.8` `10.6.6` `11.2.10` `11.3.6` `10.6.5` `11.3.5` `10.6.4` `11.3.4` `10.6.3` `11.3.3` `10.6.2` `11.3.2` `11.3.1` `10.6.1` `11.3.0` `10.6.0` `11.2.9` `10.5.7` `10.5.5` `11.2.6` `10.5.4` `11.2.5` `10.5.3` `11.2.4` `10.5.2` `11.2.3` `10.5.1` `11.2.2` `11.2.1` `11.2.0` `10.5.0`

CVE-2026-9082

Affected versions

Repository

Description

References