CVE-2026-9082

Drupal heeft een kwetsbaarheid verholpen in Drupal core (versies vanaf 8.9.0 tot specifieke 10.x en 11.x releases).

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Drupal Core ausnutzen, um eine SQL-Injection durchzuführen, die je nach Datenbankkonfiguration zur Offenlegung von Informationen, zur Erweiterung von Privilegien oder zur potenziellen Ausführung von Remote-Code führen kann.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection. This issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, from 11.0.0 before 11.1.10, from 11.2.0 before 11.2.12, from 11.3.0 before 11.3.10.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection. This issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, from 11.0.0 before 11.1.10, from 11.2.0 before 11.2.12, from 11.3.0 before 11.3.10.

Drupal core includes a database abstraction API to ensure that queries executed against the database are sanitized to prevent SQL injection attacks. A vulnerability in this API allows an attacker to send specially crafted requests, resulting in arbitrary SQL injection for sites using PostgreSQL databases. This can lead to information disclosure, and in some cases privilege escalation, remote code execution, or other attacks. This vulnerability can be exploited by anonymous users. This SQL injection vulnerability **only affects sites using PostgreSQL**. However, the third-party dependency updates in these releases apply to all sites. ### Updates **May 22 2026, 04:30 UTC:** The risk score has been updated to reflect that exploit attempts are now being detected in the wild. ### Upstream security advisories The Drupal releases for supported branches (11.3, 11.2, 10.6, and 10.5) in this advisory also include security updates for Symfony and Twig. Those projects have released important [Security Advisories](https://symfony.com/blog/category/security-advisories) that were coordinated with this Drupal release, and Drupal is affected by some of the vulnerabilities. Depending on your site configuration and contrib modules, you may be vulnerable to one or more of these upstream issues, so **updating these dependencies is highly recommended whether the SQL Injection vulnerability affects you or not**. It is also recommended to review which user roles have the ability to update Twig templates, for example via Views or contributed modules.