SA-CORE-2026-002: SQL Injection
Drupal core contains a chain of methods that could be exploitable when an insecure deserialization vulnerability exists on the site. This so-called "gadget chain" presents no direct threat, but is a vector that can be used to achieve remote code execution or SQL injection if the application deserializes untrusted data due to another vulnerability. This issue is not directly exploitable. This issue is mitigated by the fact that in order for it to be exploitable, a separate vulnerability must be present to allow an attacker to pass unsafe input to unserialize(). There are no such known exploits in Drupal core.
Credit
Affected Software
Event History
Frequently Asked Questions
What is the severity of SA-CORE-2026-002?
SA-CORE-2026-002 has a moderate severity rating due to its potential to be exploited for remote code execution or SQL injection.
How do I fix SA-CORE-2026-002?
To fix SA-CORE-2026-002, update your Drupal installation to the latest versions: 10.5.10, 10.6.8, 11.2.12, or 11.3.8.
What versions of Drupal are affected by SA-CORE-2026-002?
SA-CORE-2026-002 affects Drupal versions up to 10.6.7 and 11.3.7, and including version 10.5.9.
Can SA-CORE-2026-002 lead to data breaches?
Yes, if exploited, SA-CORE-2026-002 could lead to remote code execution or SQL injection, resulting in potential data breaches.
Is there a way to mitigate the risks associated with SA-CORE-2026-002?
Mitigation strategies for SA-CORE-2026-002 include applying available security updates and conducting a thorough security assessment of your application.