SA-CORE-2026-006: SQL Injection
Drupal core contains a chain of methods that could be exploitable when an insecure deserialization vulnerability exists on the site. This so-called "gadget chain" presents no direct threat, but is a vector that can be used to achieve remote code execution or SQL injection if the application deserializes untrusted data due to another vulnerability. This issue is not directly exploitable. This issue is mitigated by the fact that in order for it to be exploitable, a separate vulnerability must be present to allow an attacker to pass unsafe input to unserialize().
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 11.3.12Fixed in 11.2.14Fixed in 10.6.11Fixed in 10.5.12 - Upgrade
Upgrade
Drupal coreto a version that resolves this vulnerability.Fixed in 11.3.12 - Upgrade
Upgrade
Drupal coreto a version that resolves this vulnerability.Fixed in 11.2.14 - Upgrade
Upgrade
Drupal coreto a version that resolves this vulnerability.Fixed in 10.6.11 - Upgrade
Upgrade
Drupal coreto a version that resolves this vulnerability.Fixed in 10.5.12 - Configuration
Review core, contributed modules, and custom code for any calls to PHP unserialize() and ensure they never receive untrusted input. Remove or refactor unsafe unserialize() usage, validate and sanitize inputs, and apply available fixes so that untrusted data is not deserialized.
Drupal core use of PHP unserialize() on untrusted input = do not pass untrusted data to unserialize()
Event History
Frequently Asked Questions
What is the severity of SA-CORE-2026-006?
The severity of SA-CORE-2026-006 is critical with a rating of 9.
How do I fix SA-CORE-2026-006?
To fix SA-CORE-2026-006, ensure you update your Drupal core to the latest version that addresses this vulnerability.
What are the potential impacts of SA-CORE-2026-006?
SA-CORE-2026-006 could lead to remote code execution or SQL injection if exploited through the insecure deserialization vulnerability.
When was SA-CORE-2026-006 published?
SA-CORE-2026-006 was published on June 17, 2026.
What should I do if my site is affected by SA-CORE-2026-006?
If your site is affected by SA-CORE-2026-006, you should immediately perform a security audit and apply the necessary updates to your Drupal installation.