Vulnerability-Lookup

CERTFR-2026-AVI-0629

Vulnerability from certfr_avis - Published: 2026-05-21 - Updated: 2026-05-21

Une vulnérabilité a été découverte dans Drupal. Elle permet à un attaquant de provoquer une injection SQL (SQLi).

L'éditeur précise que la vulnérabilité CVE-2026-9082 affecte uniquement les applications qui utilisent PostgreSQL comme système de gestion de base de données.
Cependant, il recommande néanmoins l'installation du correctif pour toutes les instances du fait des mises à jour de dépendances également incluses dans les dernières versions.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

L'éditeur rappelle que les versions 11.1.x, 11.0.x, 10.4.x, 9.x et 8.x sont en fin de vie et ne reçoivent un correctif pour la vulnérabilité CVE-2026-9082 qu'à titre exceptionnel, au vu de sa criticité.
Ces versions n'incluent pas de correctif pour toutes les autres vulnérabilités découvertes depuis leurs fins de support respectives. L'éditeur invite donc à migrer vers une version supportée et à jour.

Impacted products

Vendor	Product	Description
Drupal	Drupal	Drupal versions 11.2.x antérieures à 11.2.12
Drupal	Drupal	Drupal versions 10.6.x antérieures à 10.6.9
Drupal	Drupal	Drupal versions 10.x antérieures à 10.4.10
Drupal	Drupal	Drupal versions 9.x antérieures à 9.5 sans le dernier correctif de sécurité
Drupal	Drupal	Drupal versions 11.3.x antérieures à 11.3.10
Drupal	Drupal	Drupal versions 11.x antérieures à 11.1.10
Drupal	Drupal	Drupal versions 8.x antérieures à 8.9 sans le dernier correctif de sécurité
Drupal	Drupal	Drupal versions 10.5.x antérieures à 10.5.10

References

Title

Publication Time

Tags

Bulletin de sécurité Drupal SA-CORE-2026-004

2026-05-20

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Drupal versions 11.2.x ant\u00e9rieures \u00e0 11.2.12",
      "product": {
        "name": "Drupal",
        "vendor": {
          "name": "Drupal",
          "scada": false
        }
      }
    },
    {
      "description": "Drupal versions 10.6.x ant\u00e9rieures \u00e0 10.6.9",
      "product": {
        "name": "Drupal",
        "vendor": {
          "name": "Drupal",
          "scada": false
        }
      }
    },
    {
      "description": "Drupal versions 10.x ant\u00e9rieures \u00e0 10.4.10",
      "product": {
        "name": "Drupal",
        "vendor": {
          "name": "Drupal",
          "scada": false
        }
      }
    },
    {
      "description": "Drupal versions 9.x ant\u00e9rieures \u00e0 9.5 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "Drupal",
        "vendor": {
          "name": "Drupal",
          "scada": false
        }
      }
    },
    {
      "description": "Drupal versions 11.3.x ant\u00e9rieures \u00e0 11.3.10",
      "product": {
        "name": "Drupal",
        "vendor": {
          "name": "Drupal",
          "scada": false
        }
      }
    },
    {
      "description": "Drupal versions 11.x ant\u00e9rieures \u00e0 11.1.10",
      "product": {
        "name": "Drupal",
        "vendor": {
          "name": "Drupal",
          "scada": false
        }
      }
    },
    {
      "description": "Drupal versions 8.x ant\u00e9rieures \u00e0 8.9 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "Drupal",
        "vendor": {
          "name": "Drupal",
          "scada": false
        }
      }
    },
    {
      "description": "Drupal versions 10.5.x ant\u00e9rieures \u00e0 10.5.10",
      "product": {
        "name": "Drupal",
        "vendor": {
          "name": "Drupal",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "L\u0027\u00e9diteur rappelle que les versions 11.1.x, 11.0.x, 10.4.x, 9.x et 8.x sont en fin de vie et ne re\u00e7oivent un correctif pour la vuln\u00e9rabilit\u00e9 CVE-2026-9082 qu\u0027\u00e0 titre exceptionnel, au vu de sa criticit\u00e9.\u003cbr\u003e\nCes versions n\u0027incluent pas de correctif pour toutes les autres vuln\u00e9rabilit\u00e9s d\u00e9couvertes depuis leurs fins de support respectives. L\u0027\u00e9diteur invite donc \u00e0 migrer vers une version support\u00e9e et \u00e0 jour.",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-9082",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-9082"
    }
  ],
  "initial_release_date": "2026-05-21T00:00:00",
  "last_revision_date": "2026-05-21T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-0629",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-05-21T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection SQL (SQLi)"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Drupal. Elle permet \u00e0 un attaquant de provoquer une injection SQL (SQLi).\n\nL\u0027\u00e9diteur pr\u00e9cise que la vuln\u00e9rabilit\u00e9 CVE-2026-9082 affecte uniquement les applications qui utilisent PostgreSQL comme syst\u00e8me de gestion de base de donn\u00e9es.\u003cbr\u003e \nCependant, il recommande n\u00e9anmoins l\u0027installation du correctif pour toutes les instances du fait des mises \u00e0 jour de d\u00e9pendances \u00e9galement incluses dans les derni\u00e8res versions.",
  "title": "Vuln\u00e9rabilit\u00e9 dans Drupal",
  "vendor_advisories": [
    {
      "published_at": "2026-05-20",
      "title": "Bulletin de s\u00e9curit\u00e9 Drupal SA-CORE-2026-004",
      "url": "https://drupal.org/sa-core-2026-004"
    }
  ]
}

CVE-2026-9082 (GCVE-0-2026-9082)

Vulnerability from cvelistv5 – Published: 2026-05-20 18:20 – Updated: 2026-05-21 13:05

Title

Drupal core - Highly critical - SQL injection - SA-CORE-2026-004

Summary

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection. This issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, from 11.0.0 before 11.1.10, from 11.2.0 before 11.2.12, from 11.3.0 before 11.3.10.

Severity ?

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Assigner

drupal

References

1 reference

URL	Tags
https://www.drupal.org/sa-core-2026-004

Impacted products

1 product

Vendor	Product	Version
Drupal	Drupal core	Affected: 8.9.0 , < 10.4.10 (semver) Affected: 10.5.0 , < 10.5.10 (semver) Affected: 10.6.0 , < 10.6.9 (semver) Affected: 11.0.0 , < 11.1.10 (semver) Affected: 11.2.0 , < 11.2.12 (semver) Affected: 11.3.0 , < 11.3.10 (semver)

Date Public ?

2026-05-20 18:08

Credits

Michael Maturi (michaelmaturi) Björn Brala (bbrala) Benji Fisher (benjifisher) catch (catch) Lee Rowlands (larowlan) Dave Long (longwave) Drew Webber (mcdruid) Jess (xjm) Anna Kalata (akalata) Benji Fisher (benjifisher) catch (catch) Damien McKenna (damienmckenna) Neil Drumm (drumm) Greg Knaddison (greggles) Heine Deelstra (heine) Tim Hestenes Lehnen (hestenet) Dave Long (longwave) Drew Webber (mcdruid) Juraj Nemec (poker10) Pierre Rudloff (prudloff) Jess (xjm) Cathy Theys (yesct)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-9082",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-21T03:55:40.323330Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-89",
                "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-21T13:05:49.838Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/drupal",
          "defaultStatus": "unaffected",
          "product": "Drupal core",
          "repo": "https://git.drupalcode.org/project/drupal",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "10.4.10",
              "status": "affected",
              "version": "8.9.0",
              "versionType": "semver"
            },
            {
              "lessThan": "10.5.10",
              "status": "affected",
              "version": "10.5.0",
              "versionType": "semver"
            },
            {
              "lessThan": "10.6.9",
              "status": "affected",
              "version": "10.6.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.1.10",
              "status": "affected",
              "version": "11.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.2.12",
              "status": "affected",
              "version": "11.2.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.3.10",
              "status": "affected",
              "version": "11.3.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Michael Maturi (michaelmaturi)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Bj\u00f6rn Brala (bbrala)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Benji Fisher (benjifisher)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "catch (catch)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Lee Rowlands (larowlan)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Dave Long (longwave)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Drew Webber (mcdruid)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Jess  (xjm)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Anna Kalata (akalata)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Benji Fisher (benjifisher)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "catch (catch)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Damien McKenna (damienmckenna)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Neil Drumm (drumm)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Greg Knaddison (greggles)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Heine Deelstra (heine)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Tim Hestenes Lehnen (hestenet)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Dave Long (longwave)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Drew Webber (mcdruid)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Juraj Nemec (poker10)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Pierre Rudloff (prudloff)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Jess  (xjm)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Cathy Theys (yesct)"
        }
      ],
      "datePublic": "2026-05-20T18:08:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027) vulnerability in Drupal Drupal core allows SQL Injection.\u003cp\u003eThis issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, from 11.0.0 before 11.1.10, from 11.2.0 before 11.2.12, from 11.3.0 before 11.3.10.\u003c/p\u003e"
            }
          ],
          "value": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027) vulnerability in Drupal Drupal core allows SQL Injection.\n\nThis issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, from 11.0.0 before 11.1.10, from 11.2.0 before 11.2.12, from 11.3.0 before 11.3.10."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-66",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-66 SQL Injection"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-20T18:20:52.863Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-core-2026-004"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Drupal core - Highly critical - SQL injection - SA-CORE-2026-004",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-9082",
    "datePublished": "2026-05-20T18:20:52.863Z",
    "dateReserved": "2026-05-20T13:35:13.119Z",
    "dateUpdated": "2026-05-21T13:05:49.838Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted