Drupal 'Drupalgeddon2' Remote Code Execution

Description

A vulnerability in multiple subsystems of Drupal allows remote attackers to execute arbitrary operating system commands on the server, leading to potential compromise of the affected system.

Recommendation

Mitigate the risk by upgrading Drupal to the latest stable version that includes patches for the vulnerability.

References

• Drupal
• CVE-2018-7600
• CWE-20
• CWE-78
• CAPEC-88
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• DbGate: Remote Code Execution via functionName injection in loadReader endpoint - CVE-2026-48017
• Authenticated Remote Code Execution via loadReader functionName code injection in DbGate - CVE-2026-47670
• Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified - CVE-2026-69255
• Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability - flowise-components - CVE-2026-70477

You might also like:

These 7 PHP mistakes leave your website open to the hackers

CSRF, XXE, and 12 Other Security Acronyms Explained

How do hackers hack websites?

Tags:

RCE

Drupal

Injection