Vulnerability advisory

GHSA-7fh9-933g-885p

Drupal Core Remote Code Execution Vulnerability

Published May 14, 2022Updated Dec 10, 2025OSV record ↗

Also known as CVE-2018-7600DRUPAL-CORE-2018-002

Severity

CVSS 3.xCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H

Affected versions

drupal/core Packagist

All drupal/core advisories →

Affected	Fixed in
`7.0` to before 7.58	`7.58`Advisories →
`8.0` to before 8.3.9	`8.3.9`Advisories →
Also listed as affected (63) `8.0.0` `8.0.0-beta10` `8.0.0-beta11` `8.0.0-beta12` `8.0.0-beta13` `8.0.0-beta14` `8.0.0-beta15` `8.0.0-beta16` `8.0.0-beta6` `8.0.0-beta7` `8.0.0-beta8` `8.0.0-beta9` `8.0.0-rc1` `8.0.0-rc2` `8.0.0-rc3` `8.0.0-rc4` `8.0.1` `8.0.2` `8.0.3` `8.0.4` `8.0.5` `8.0.6` `8.1.0` `8.1.0-beta1` `8.1.0-beta2` `8.1.0-rc1` `8.1.1` `8.1.10` `8.1.2` `8.1.3` `8.1.4` `8.1.5` `8.1.6` `8.1.7` `8.1.8` `8.1.9` `8.2.0` `8.2.0-beta1` `8.2.0-beta2` `8.2.0-beta3` `8.2.0-rc1` `8.2.0-rc2` `8.2.1` `8.2.2` `8.2.3` `8.2.4` `8.2.5` `8.2.6` `8.2.7` `8.2.8` `8.3.0` `8.3.0-alpha1` `8.3.0-beta1` `8.3.0-rc1` `8.3.0-rc2` `8.3.1` `8.3.2` `8.3.3` `8.3.4` `8.3.5` `8.3.6` `8.3.7` `8.3.8`
`8.4.0` to before 8.4.6	`8.4.6`Advisories →
Also listed as affected (6) `8.4.0` `8.4.1` `8.4.2` `8.4.3` `8.4.4` `8.4.5`
`8.5.0` to before 8.5.1	`8.5.1`Advisories →
Also listed as affected (1) `8.5.0`

drupal/drupal Packagist

All drupal/drupal advisories →

Affected	Fixed in
`7.0` to before 7.58	`7.58`Advisories →
`8.0` to before 8.3.9	`8.3.9`Advisories →
Also listed as affected (69) `8.0.0` `8.0.0-alpha14` `8.0.0-alpha15` `8.0.0-beta1` `8.0.0-beta10` `8.0.0-beta11` `8.0.0-beta12` `8.0.0-beta13` `8.0.0-beta14` `8.0.0-beta15` `8.0.0-beta16` `8.0.0-beta2` `8.0.0-beta3` `8.0.0-beta4` `8.0.0-beta5` `8.0.0-beta6` `8.0.0-beta7` `8.0.0-beta9` `8.0.0-rc1` `8.0.0-rc2` `8.0.0-rc3` `8.0.0-rc4` `8.0.1` `8.0.2` `8.0.3` `8.0.4` `8.0.5` `8.0.6` `8.1.0` `8.1.0-beta1` `8.1.0-beta2` `8.1.0-rc1` `8.1.1` `8.1.10` `8.1.2` `8.1.3` `8.1.4` `8.1.5` `8.1.6` `8.1.7` `8.1.8` `8.1.9` `8.2.0` `8.2.0-beta1` `8.2.0-beta2` `8.2.0-beta3` `8.2.0-rc1` `8.2.0-rc2` `8.2.1` `8.2.2` `8.2.3` `8.2.4` `8.2.5` `8.2.6` `8.2.7` `8.2.8` `8.3.0` `8.3.0-alpha1` `8.3.0-beta1` `8.3.0-rc1` `8.3.0-rc2` `8.3.1` `8.3.2` `8.3.3` `8.3.4` `8.3.5` `8.3.6` `8.3.7` `8.3.8`
`8.4` to before 8.4.6	`8.4.6`Advisories →
Also listed as affected (10) `8.4.0` `8.4.0-alpha1` `8.4.0-beta1` `8.4.0-rc1` `8.4.0-rc2` `8.4.1` `8.4.2` `8.4.3` `8.4.4` `8.4.5`
`8.5` to before 8.5.1	`8.5.1`Advisories →
Also listed as affected (4) `8.5.0` `8.5.0-alpha1` `8.5.0-beta1` `8.5.0-rc1`

Description

Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.

GHSA-7fh9-933g-885p

Affected versions

drupal/core Packagist

drupal/drupal Packagist

Description

References