Critical Drupal Core Vulnerability Puts PostgreSQL Sites at Risk of RCE
Drupal has published security updates to address a serious weakness in Drupal Core that attackers could leverage to run arbitrary code, elevate privileges, or expose sensitive data.
Drupal says the problem stems from its database abstraction layer, which is responsible for validating queries and helping prevent SQL injection.
Specifically, a flaw in that API can be triggered by specially crafted requests, allowing attackers to perform arbitrary SQL injection on sites that use PostgreSQL as their database backend. Such exploitation can result in information disclosure and, in some instances, privilege escalation, remote code execution, or other malicious outcomes.
Drupal warns the vulnerability can be exploited by unauthenticated (anonymous) users and affects only installations backed by PostgreSQL. The following releases include fixes for the issue:
- Drupal 11.3.10
- Drupal 11.2.12
- Drupal 11.1.10
- Drupal 10.6.9
- Drupal 10.5.10
- Drupal 10.4.10
Sites running Drupal 7 are not impacted by this defect. The patched builds for the supported branches (11.3, 11.2, 10.6, and 10.5) also incorporate upstream security updates for Symfony and Twig, so administrators should apply the latest updates without delay.
Drupal also published manual fixes for older, unsupported releases such as Drupal 9 and Drupal 8, which have reached end-of-life. According to Drupal, branches like 11.1.x, 11.0.x, 10.4.x and earlier are no longer covered by official security support, and both Drupal 8 and Drupal 9 are out of active maintenance.
Because of the issue’s severity, maintainers provided these unofficial patches for unsupported versions on a best-effort basis. However, those legacy releases may still contain other previously disclosed vulnerabilities and should not be considered fully secure.
For more details and official advisories, consult Drupal’s security resources and the CVE entry (CVE-2026-9082).