0xBlackash/CVE-2026-9082

## 📋 Overview **CVE-2026-9082** is a **SQL Injection** vulnerability in Drupal Core’s database abstraction layer. It affects only sites using **PostgreSQL** as the database backend. The vulnerability allows unauthenticated attackers to perform arbitrary SQL injection, potentially leading to data leakage, privilege escalation, and in worst cases, remote code execution. ## 🛡️ Severity | Metric | Value | |---------------------|------------------------| | **CVSS v3 Score** | **6.5 (Medium)** | | **Attack Vector** | Network | | **Complexity** | Low | | **Privileges** | None | | **User Interaction**| None | | **Impact** | Confidentiality + Integrity | **Drupal's Internal Assessment**: Highly Critical (especially for PostgreSQL sites). ## 📌 Affected Versions | Drupal Version | Affected Range | Fixed Version | |----------------------|-----------------------------|-------------------| | Drupal 8.9 | 8.9.0 → 10.4.9 | **10.4.10** | | Drupal 10.5 | 10.5.0 → 10.5.9 | **10.5.10** | | Drupal 10.6 | 10.6.0 → 10.6.8 | **10.6.9** | | Drupal 11.0 | 11.0.0 → 11.1.9 | **11.1.10** | | Drupal 11.2 | 11.2.0 → 11.2.11 | **11.2.12** | | Drupal 11.3 | 11.3.0 → 11.3.9 | **11.3.10** | **Not Affected**: - Drupal 7.x (all versions) - Sites using **MySQL** or **MariaDB** - Sites using SQLite ## 🔧 Mitigation ### Immediate Action **Update Drupal Core immediately** to one of the fixed versions listed above. ### Quick Commands # Using Composer (recommended) composer update drupal/core-recommended --with-dependencies # Or update to a specific secure version composer require drupal/core:11.3.10 ### Additional Recommendations - Enable automatic updates if possible - Review database logs for suspicious queries - Consider temporary WAF rules blocking PostgreSQL-specific payloads if patching is delayed ## 🛠 Technical Details - **Vulnerability Type**: Improper Neutralization of Special Elements used in an SQL Command (`'SQL Injection'`) - **Location**: Drupal Core Database Abstraction API - **Exploitable By**: Anonymous / Unauthenticated users - **Trigger**: Certain database queries using PostgreSQL-specific features ## 📚 References - **Official Advisory**: [SA-CORE-2026-004](https://www.drupal.org/sa-core-2026-004) - **CVE Entry**: CVE-2026-9082 - **Drupal Security Team**