NewApp Monitoring is liveSign up free
AgentbeamBeta
Open-source package vulnerability · Composer (PHP)

CVE-2026-9082: Drupal Core has a SQL Injection issue

criticalCVSS 3.1 9.8ExploitedGHSA-ghwc-95x2-682j

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection. This issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, from 11.0.0 before 11.1.10, from 11.2.0 before 11.2.12, from 11.3.0 before 11.3.10.

Published May 20, 2026 · Updated Jun 18, 2026

Affected packages

drupal/core

Ecosystem
Composer (PHP)
Affected
>= 8.9.0, < 10.4.10
Fixed in
10.4.10
Check
composer show drupal/core

drupal/core

Ecosystem
Composer (PHP)
Affected
>= 10.5.0, < 10.5.10
Fixed in
10.5.10
Check
composer show drupal/core

drupal/core

Ecosystem
Composer (PHP)
Affected
>= 10.6.0, < 10.6.9
Fixed in
10.6.9
Check
composer show drupal/core

drupal/core

Ecosystem
Composer (PHP)
Affected
>= 11.0.0, < 11.1.10
Fixed in
11.1.10
Check
composer show drupal/core

drupal/core

Ecosystem
Composer (PHP)
Affected
>= 11.2.0, < 11.2.12
Fixed in
11.2.12
Check
composer show drupal/core

drupal/core

Ecosystem
Composer (PHP)
Affected
>= 11.3.0, < 11.3.10
Fixed in
11.3.10
Check
composer show drupal/core

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection.

This issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, from 11.0.0 before 11.1.10, from 11.2.0 before 11.2.12, from 11.3.0 before 11.3.10.

Credited to Rudloff, orbegam.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More Composer (PHP) vulnerabilities

All Composer (PHP) entries