What it is
Improper sanitization in the extension file names is present in Drupal core.
What to do
Apply updates per vendor instructions.
Vendor notices and references
Description and required action as published by CISA. Full record at NVD.
Other Drupal entries on the list
- Core Drupal Core SQL Injection Vulnerability CVE-2026-9082 · May 22, 2026
- Core Drupal Core Remote Code Execution Vulnerability CVE-2018-7602 · Apr 13, 2022
- Core Drupal Core Remote Code Execution Vulnerability CVE-2019-6340 · Mar 25, 2022
- Drupal Core Drupal Core Remote Code Execution Vulnerability CVE-2018-7600 · Nov 3, 2021