CVE-2018-7600: Drupal Core Remote Code Execution Vulnerability

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: yes — in CISA KEV since 2021-11-03
EPSS: 100.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-03-29 · updated 2026-06-17
Weakness: CWE-20

Description

Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.

Affected products

Debian Linux: 7.0, 8.0, 9.0
Drupal: through 7.57; from 8.0.0 before 8.3.9; from 8.4.0 before 8.4.6; from 8.5.0 before 8.5.1 — fixed in 8.3.9, 8.4.6, 8.5.1

How to fix

Upgrade to a fixed version: Drupal 8.3.9, 8.4.6, 8.5.1. Check the vendor advisory for mitigations.

References

http://www.securityfocus.com/bid/103534
http://www.securitytracker.com/id/1040598
https://badpackets.net/over-100000-drupal-websites-vulnerable-to-drupalgeddon-2-cve-2018-7600/
https://blog.appsecco.com/remote-code-execution-with-drupal-core-sa-core-2018-002-95e6ecc0c714
https://github.com/a2u/CVE-2018-7600
https://github.com/g0rx/CVE-2018-7600-Drupal-RCE
https://greysec.net/showthread.php?tid=2912&pid=10561
https://groups.drupal.org/security/faq-2018-002
https://lists.debian.org/debian-lts-announce/2018/03/msg00028.html
https://research.checkpoint.com/uncovering-drupalgeddon-2/
https://twitter.com/RicterZ/status/979567469726613504
https://twitter.com/RicterZ/status/984495201354854401

Get alerted when CVE-2018-7600 or the next vulnerability affects your stack