Drupal Patches Highly Critical Vulnerability Exposing Websites to Hacking
Drupal has patched a highly critical vulnerability that could allow threat actors to hack websites powered by the open source content management system (CMS).
The developers of the CMS had alerted users prior to the patch’s release that an exploit might be created within hours or days of disclosure.
The vulnerability, tracked as CVE-2026-9082 and rated ‘highly critical’ with a NIST CMSS score of 20 out of 25, affects an API designed to ensure that database queries are sanitized to prevent SQL injection attacks.
“A vulnerability in this API allows an attacker to send specially crafted requests, resulting in arbitrary SQL injection for sites using PostgreSQL databases,” Drupal explains.
It warns that the flaw can be exploited without authentication to obtain information and in some cases for privilege escalation and remote code execution.
Drupal powers hundreds of thousands of websites, but CVE-2026-9082 only affects sites that use PostgreSQL.
Advertisement. Scroll...
Copyright of this story solely belongs to securityweek.com. To see the full text click HERE
