Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because o

Summary

Drupal, a widely used open-source content management system, is affected by this vulnerability. An attacker located remotely could exploit it to run arbitrary code on the affected website's server, potentially taking full control of the system.

Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.

Timeline

1. Mar 29, 2018, 7:00 AM UTCCVE published
2. Nov 3, 2021Added to CISA KEV

   CISA has evidence of exploitation in the wild

3. May 3, 2022CISA remediation deadline

   Due date for US federal agencies to patch

4. Oct 21, 2025, 11:45 PM UTCRecord last updated
5. Oct 22, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• n/a Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1

  Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1

• drupal/corePackagist

  From 8.0.0 · fixed in 8.3.9; From 8.4.0 · fixed in 8.4.6; From 8.5.0 · fixed in 8.5.1

• drupal/corePackagist

  From 7.0 · fixed in 7.58

• drupal/corePackagist

  From 8.0 · fixed in 8.3.9

• drupal/corePackagist

  From 8.4.0 · fixed in 8.4.6

• drupal/corePackagist

  From 8.5.0 · fixed in 8.5.1

• drupal/drupalPackagist

  From 7.0 · fixed in 7.58

• drupal/drupalPackagist

  From 8.0 · fixed in 8.3.9

• drupal/drupalPackagist

  From 8.4 · fixed in 8.4.6

• drupal/drupalPackagist

  From 8.5 · fixed in 8.5.1

References 20