Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.

Affected Packages

Packagist drupal/core

Affected versions: 7.0 (fixed in 7.58)

Packagist drupal/core

Affected versions: 8.0 (fixed in 8.3.9)

Packagist drupal/core

Affected versions: 8.4.0 (fixed in 8.4.6)

Packagist drupal/core

Affected versions: 8.5.0 (fixed in 8.5.1)

Packagist drupal/drupal

Affected versions: 7.0 (fixed in 7.58)

Packagist drupal/drupal

Affected versions: 8.0 (fixed in 8.3.9)

Packagist drupal/drupal

Affected versions: 8.4 (fixed in 8.4.6)

Packagist drupal/drupal

Affected versions: 8.5 (fixed in 8.5.1)

Related CVEs

CVE-2018-7600

Key Information

GHSA ID

GHSA-7fh9-933g-885p

Published

May 14, 2022 1:29 AM

Last Modified

April 23, 2024 10:36 PM

CVSS Score

9.0 /10

Primary Ecosystem

Packagist

Primary Package

drupal/core

GitHub Reviewed

✓ Yes

Dataset

Last updated: September 19, 2025 6:29 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.