What it is
In Drupal Core, some field types do not properly sanitize data from non-form sources. This can lead to arbitrary PHP code execution in some cases.
What to do
Apply updates per vendor instructions.
Vendor notices and references
Description and required action as published by CISA. Full record at NVD.
Other Drupal entries on the list
- Core Drupal Core SQL Injection Vulnerability CVE-2026-9082 · May 22, 2026
- Core Drupal Core Remote Code Execution Vulnerability CVE-2018-7602 · Apr 13, 2022
- Drupal core Drupal core Un-restricted Upload of File CVE-2020-13671 · Jan 18, 2022
- Drupal Core Drupal Core Remote Code Execution Vulnerability CVE-2018-7600 · Nov 3, 2021