Open-source package vulnerability · Composer (PHP)

GHSA-6mgp-v5cm-ghg5: Drupal core Remote Code Execution

critical

In Drupal core, when sending email some variables were not being sanitized for shell arguments in DefaultMailSystem::mail(), which could lead to remote code execution.

Published May 15, 2024

Affected packages

drupal/core

Ecosystem: Composer (PHP)
Affected: >= 7.0, < 7.60
Fixed in: 7.60
Check: composer show drupal/core

drupal/core

Ecosystem: Composer (PHP)
Affected: >= 8.0.0, < 8.5.8
Fixed in: 8.5.8
Check: composer show drupal/core

drupal/core

Ecosystem: Composer (PHP)
Affected: >= 8.6.0, < 8.6.2
Fixed in: 8.6.2
Check: composer show drupal/core

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

In Drupal core, when sending email some variables were not being sanitized for shell arguments in DefaultMailSystem::mail(), which could lead to remote code execution.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More Composer (PHP) vulnerabilities

All Composer (PHP) entries