CVE-2026-9082

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection. This issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, from 11.0.0 before 11.1.10, from 11.2.0 before 11.2.12, from 11.3.0 before 11.3.10.

Affected products

Drupal, Postgresql

Drupal

< 10.4.10, 10.5.10, 10.6.9, 11.1.10, 11.2.12, 11.3.10

Fix

Available

CVSS 3.1

9.8 CRITICAL

EPSS

88.3% (100th percentile)

Weakness

CWE-89

NVD status

Analyzed

Published

2026-05-20

Attack patterns

CAPEC-66

Entry point

filter[a][condition][value][<injected-key>] query param

Path

/jsonapi/node/article