Open-source package vulnerability · Composer (PHP)
GHSA-jf8c-36vw-98x4: Drupal core Remote Code Execution
critical
In Drupal core, when sending email some variables were not being sanitized for shell arguments in DefaultMailSystem::mail(), which could lead to remote code execution.
Published May 15, 2024
Affected packages
drupal/drupal
- Ecosystem
- Composer (PHP)
- Affected
- >= 7.0, < 7.60
- Fixed in
- 7.60
- Check
composer show drupal/drupal
drupal/drupal
- Ecosystem
- Composer (PHP)
- Affected
- >= 8.0.0, < 8.5.8
- Fixed in
- 8.5.8
- Check
composer show drupal/drupal
drupal/drupal
- Ecosystem
- Composer (PHP)
- Affected
- >= 8.6.0, < 8.6.2
- Fixed in
- 8.6.2
- Check
composer show drupal/drupal
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
In Drupal core, when sending email some variables were not being sanitized for shell arguments in DefaultMailSystem::mail(), which could lead to remote code execution.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology