Vulnerability advisory

DRUPAL-CORE-2018-002

Published Mar 28, 2018Updated Dec 10, 2025OSV record ↗

Also known as CVE-2018-7600GHSA-7fh9-933g-885p

Severity

Severity not reported.

Affected versions

drupal/core Packagist

Affected	Fixed in
`8.0.0` to before 8.3.9	`8.3.9`Advisories →
`8.4.0` to before 8.4.6	`8.4.6`Advisories →
`8.5.0` to before 8.5.1	`8.5.1`Advisories →
Also listed as affected (55) `8.0.0` `8.0.1` `8.0.2` `8.0.3` `8.0.4` `8.0.5` `8.0.6` `8.1.0` `8.1.0-beta1` `8.1.0-beta2` `8.1.0-rc1` `8.1.1` `8.1.10` `8.1.2` `8.1.3` `8.1.4` `8.1.5` `8.1.6` `8.1.7` `8.1.8` `8.1.9` `8.2.0` `8.2.0-beta1` `8.2.0-beta2` `8.2.0-beta3` `8.2.0-rc1` `8.2.0-rc2` `8.2.1` `8.2.2` `8.2.3` `8.2.4` `8.2.5` `8.2.6` `8.2.7` `8.2.8` `8.3.0` `8.3.0-alpha1` `8.3.0-beta1` `8.3.0-rc1` `8.3.0-rc2` `8.3.1` `8.3.2` `8.3.3` `8.3.4` `8.3.5` `8.3.6` `8.3.7` `8.3.8` `8.4.0` `8.4.1` `8.4.2` `8.4.3` `8.4.4` `8.4.5` `8.5.0`

Description

A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being completely compromised.

The security team has written an FAQ about this issue.

Edited 2020, February 13 to fix links to patch files.

References

Webwww.drupal.org/sa-core-2018-002 ↗