CVE-2018-7600 — Vulnerability in drupal/core — CVE Details
Drupal Core Remote Code Execution Vulnerability
What Should I Do?
Patch Immediately
This vulnerability is confirmed under active exploitation (CISA KEV). Patch within 24-48 hours if possible.
Summary
Advisory Timeline
- First published May 14, 2022 (1612 days ago).
- Last revised December 10, 2025 — 1307 days after initial publication.
- Added to CISA's Known Exploited Vulnerabilities catalog 192 days before publication.
Remediation
Upgrade to the fixed version using your package manager.
composer require "drupal/core:^7.58"
composer require "drupal/drupal:^8.3.9"
composer require "drupal/drupal:^8.4.6"
composer require "drupal/core:^8.4.6"
composer require "drupal/core:^8.3.9"
composer require "drupal/drupal:^7.58"
composer require "drupal/core:^8.5.1"
composer require "drupal/drupal:^8.5.1"
After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.
Affected Packages (8)
Affects 1 ecosystem: packagist (2).
| Package | Ecosystem | Affected | Fixed In |
|---|---|---|---|
| drupal/core | packagist | All versions | 7.58 |
| drupal/drupal | packagist | 8.0.0, 8.0.0-alpha14, 8.0.0-alpha15, 8.0.0-beta1 (+65 more) | 8.3.9 |
| drupal/drupal | packagist | 8.4.0, 8.4.0-alpha1, 8.4.0-beta1, 8.4.0-rc1 (+6 more) | 8.4.6 |
| drupal/core | packagist | 8.4.0, 8.4.1, 8.4.2, 8.4.3 (+2 more) | 8.4.6 |
| drupal/core | packagist | 8.0.0, 8.0.0-beta10, 8.0.0-beta11, 8.0.0-beta12 (+59 more) | 8.3.9 |
| drupal/drupal | packagist | All versions | 7.58 |
| drupal/core | packagist | 8.5.0 | 8.5.1 |
| drupal/drupal | packagist | 8.5.0, 8.5.0-alpha1, 8.5.0-beta1, 8.5.0-rc1 | 8.5.1 |
Vulnerability Classification
Common Weakness Enumeration (CWE) identifiers for this vulnerability type.
- CWE-20Improper Input ValidationMITRE
CVSS Score Breakdown
What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
References
- https://nvd.nist.gov/vuln/detail/CVE-2018-7600ADVISORY
- https://www.tenable.com/blog/critical-drupal-core-vulnerability-what-you-need-to-knowWEB
- https://www.synology.com/support/security/Synology_SA_18_17WEB
- https://www.exploit-db.com/exploits/44482WEB
- https://www.exploit-db.com/exploits/44449WEB
- https://www.exploit-db.com/exploits/44448WEB
- https://www.drupal.org/sa-core-2018-002WEB
- https://www.debian.org/security/2018/dsa-4156WEB
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-7600WEB
- https://twitter.com/arancaytar/status/979090719003627521WEB
- https://twitter.com/RicterZ/status/984495201354854401WEB
- https://twitter.com/RicterZ/status/979567469726613504WEB
- https://research.checkpoint.com/uncovering-drupalgeddon-2WEB
- https://lists.debian.org/debian-lts-announce/2018/03/msg00028.htmlWEB
- https://groups.drupal.org/security/faq-2018-002WEB
- https://greysec.net/showthread.php?tid=2912&pid=10561WEB
- https://github.com/g0rx/CVE-2018-7600-Drupal-RCEWEB
- https://github.com/drupal/corePACKAGE
- https://github.com/a2u/CVE-2018-7600WEB
- https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2018-7600.yamlWEB
- https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2018-7600.yamlWEB
- https://blog.appsecco.com/remote-code-execution-with-drupal-core-sa-core-2018-002-95e6ecc0c714WEB
- https://badpackets.net/over-100000-drupal-websites-vulnerable-to-drupalgeddon-2-cve-2018-7600WEB
- https://www.securityfocus.com/bid/103534WEB
- https://www.securitytracker.com/id/1040598WEB
Frequently Asked Questions
- What is CVE-2018-7600?
- Drupal Core Remote Code Execution Vulnerability This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.8/10).
- How do I check if my project is affected by CVE-2018-7600?
- CVE-2018-7600 affects drupal/core and drupal/drupal. This vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, meaning it is being actively exploited in the wild. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2018-7600 and 200,000+ other known vulnerabilities.
Severity & Exploitability
Exploitation is straightforward and causes maximum impact. Patch immediately.
This vulnerability is in CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild.
Added to KEV catalog: November 3, 2021
Remediation deadline: May 3, 2022
Also Known As
Related CVEs
- CVE-2018-7602CRITICAL
Drupal Core Remote Code Execution Vulnerability
- CVE-2017-6925CRITICAL
Drupal Entity access bypass for entities that do not have UUIDs or have protected revisions
- CVE-2020-13665CRITICAL
Drupal Core Access bypass vulnerability
- CVE-2019-11831CRITICAL
Directory Traversal in typo3/phar-stream-wrapper
- CVE-2024-55638HIGH
Drupal core contains a potential PHP Object Injection vulnerability
- CVE-2020-13663HIGH
Drupal Core Cross-Site Request Forgery (CSRF) vulnerability
- CVE-2024-55637HIGH
Drupal core contains a potential PHP Object Injection vulnerability
- CVE-2020-13664HIGH
Drupal Core Arbitrary PHP code execution vulnerability
Check if you're affected
Scan your dependencies to see if this vulnerability affects your projects.
Scan Your Dependencies