{"schemaVersion":3,"id":"CVE-2018-7600","aliases":["UBUNTU-CVE-2018-7600","DLA-1325-1","DSA-4156-1"],"status":"published","duplicateOf":null,"title":"Drupal Core Remote Code Execution Vulnerability","description":"Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.","dates":{"published":"2018-03-29T07:00:00.000Z","modified":"2025-10-21T23:45:52.444Z","reserved":null,"kevAdded":["2021-11-03T00:00:00.000Z"],"kevDue":["2022-05-03T00:00:00.000Z"]},"cvss":{"headline":{"score":9.8,"severity":"critical","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":7.5,"severity":"high","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Ubuntu","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":10,"impact":9.8,"computed":true},{"version":"3.0","versionLabel":"v3.0","source":"OSV · Ubuntu","score":9.8,"severity":"critical","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":10,"impact":9.8,"computed":true}]},"epss":{"probability":0.99991,"percentile":0.99985,"severity":"critical","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.99991},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.99991,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.99991,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.99991,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.99991,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.99991,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.99991,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.99991,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.99991,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.99991,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.99991,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.99991,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.99991,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.99991,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.99991,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.99991,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.99991,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.99991,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.99991,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.99991,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.99991,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.99991,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.99991,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.99991,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.99991,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.99991,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.99991,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.99991,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.99991,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.99991,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.99991,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.99991,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.99991,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.99991,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.99991,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.99991,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.99991,"percentile":0.99985}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.99991,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.99991,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.99991,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.99991,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.99991,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.99991,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.99991,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.99991,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.99991,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.99991,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.99991,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.99991,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.99991,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.99991,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.99991,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.99991,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.99991,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.99991,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.99991,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.99991,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.99991,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.99991,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.99991,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.99991,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.99991,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.99991,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.99991,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.99991,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.99991,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.99991,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.99991,"percentile":0.99985}]},"kev":{"state":"listed","entries":[{"source":"cisa","sourceLabel":"CISA","dateAdded":"2021-11-03T00:00:00.000Z","dueDate":"2022-05-03T00:00:00.000Z","requiredAction":"Apply updates per vendor instructions.","name":"Drupal Core Remote Code Execution Vulnerability","description":"Drupal Core contains a remote code execution vulnerability that could allow an attacker to exploit multiple attack vectors on a Drupal site, resulting in complete site compromise.","notes":[{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2018-7600","label":"nvd.nist.gov/vuln/detail/CVE-2018-7600"}],"vendor":"Drupal","product":"Drupal Core","ransomware":true,"ransomwareUse":"Known","exploitationType":null}],"listedCount":1,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":true,"entry":{"source":"cisa","sourceLabel":"CISA","dateAdded":"2021-11-03T00:00:00.000Z","dueDate":"2022-05-03T00:00:00.000Z","requiredAction":"Apply updates per vendor instructions.","name":"Drupal Core Remote Code Execution Vulnerability","description":"Drupal Core contains a remote code execution vulnerability that could allow an attacker to exploit multiple attack vectors on a Drupal site, resulting in complete site compromise.","notes":[{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2018-7600","label":"nvd.nist.gov/vuln/detail/CVE-2018-7600"}],"vendor":"Drupal","product":"Drupal Core","ransomware":true,"ransomwareUse":"Known","exploitationType":null}},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"known","sources":["cisa"]},"exploits":[{"id":"REF_22B928DD4F04E425","name":"Exploit Reference (research.checkpoint.com)","source":"reference","url":"https://research.checkpoint.com/uncovering-drupalgeddon-2/","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null},{"id":"44482","name":"Drupal < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution (Metasploit)","source":"exploit-database","url":"https://www.exploit-db.com/exploits/44482","maturity":"weaponized","reliabilityScore":0.8,"verified":true,"type":"remote","platforms":["php"],"requiresAuth":null,"exploitdb":{"verified":true,"type":"remote","platform":"php","file":"exploits/php/remote/44482.rb","codes":["CVE-2018-7600"]},"metasploit":null},{"id":"44449","name":"Drupal < 7.58 / < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution","source":"exploit-database","url":"https://www.exploit-db.com/exploits/44449","maturity":"poc","reliabilityScore":0.8,"verified":true,"type":null,"platforms":["php"],"requiresAuth":null,"exploitdb":{"verified":true,"type":"webapps","platform":"php","file":"exploits/php/webapps/44449.rb","codes":["CVE-2018-7600"]},"metasploit":null},{"id":"44448","name":"Drupal < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution (PoC)","source":"exploit-database","url":"https://www.exploit-db.com/exploits/44448","maturity":"poc","reliabilityScore":0.8,"verified":true,"type":null,"platforms":["php"],"requiresAuth":null,"exploitdb":{"verified":true,"type":"webapps","platform":"php","file":"exploits/php/webapps/44448.py","codes":["CVE-2018-7600"]},"metasploit":null},{"id":"MSF_EXPLOIT_UNIX_WEBAPP_DRUPAL_DRUPALGEDDON2","name":"Drupal Drupalgeddon 2 Forms API Property Injection","source":"metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploit/unix/webapp/drupal_drupalgeddon2.rb","maturity":"weaponized","reliabilityScore":1,"verified":true,"type":"remote","platforms":[],"requiresAuth":false,"exploitdb":null,"metasploit":{"fullname":"exploit/unix/webapp/drupal_drupalgeddon2","rank":"600","rankName":"excellent","postAuth":false,"check":true,"stability":["crash-safe"],"sideEffects":[],"reliability":[]}}],"exploitCount":5,"weaknesses":[{"id":"CWE-20","name":"Improper Input Validation","description":"The product receives input or data, but it does\n        not validate or incorrectly validates that the input has the\n        properties that are required to process the data safely and\n        correctly.","type":"weakness","status":"Stable","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/20.html"}],"affected":[{"vendor":"debian","product":"drupal7","name":"drupal7","label":"drupal7","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/drupal7","purlType":"deb","versions":[{"text":"< 7.32-1+deb8u11","noFixRecorded":false,"fixedIn":null},{"text":"< 7.52-2+deb9u3","noFixRecorded":false,"fixedIn":null},{"text":"< 7.14-2+deb7u18","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 7.32-1+deb8u11 | < 7.52-2+deb9u3 | < 7.14-2+deb7u18","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"drupal7","name":"drupal7","label":"drupal7","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/drupal7","purlType":"deb","versions":[{"text":"< 7.26-1ubuntu0.1+esm1","noFixRecorded":false,"fixedIn":null},{"text":"< 7.44-1ubuntu1~16.04.0+esm1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 7.26-1ubuntu0.1+esm1 | < 7.44-1ubuntu1~16.04.0+esm1","eol":null,"hubHref":null},{"vendor":"debian","product":"debian_linux","name":"debian linux","label":"debian_linux","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"7.0","noFixRecorded":false,"fixedIn":null},{"text":"8.0","noFixRecorded":false,"fixedIn":null},{"text":"9.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"7.0 | 8.0 | 9.0","eol":{"isEol":true,"eolDate":"2018-05-31T00:00:00.000Z","matchMethod":"cpe","cycle":{"name":"7","label":"7 (Wheezy)","eolFrom":"2018-05-31T00:00:00.000Z","isLts":false,"isMaintained":false,"latestVersion":"7.11"},"product":{"name":"debian","label":"Debian","category":"os"}},"hubHref":"/vendor/debian/debian_linux"},{"vendor":"drupal","product":"drupal","name":"drupal","label":"drupal","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 7.57","noFixRecorded":false,"fixedIn":null},{"text":"≥ 8.0.0, < 8.3.9","noFixRecorded":false,"fixedIn":null},{"text":"≥ 8.4.0, < 8.4.6","noFixRecorded":false,"fixedIn":null},{"text":"≥ 8.5.0, < 8.5.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 7.57 | ≥ 8.0.0, < 8.3.9 | ≥ 8.4.0, < 8.4.6 | ≥ 8.5.0, < 8.5.1","eol":{"isEol":null,"eolDate":null,"matchMethod":"cpe","cycle":null,"product":{"name":"drupal","label":"Drupal","category":"server-app"}},"hubHref":"/vendor/drupal/drupal"}],"affectedCount":4,"eol":{"hasEol":true,"count":1},"references":[{"url":"https://github.com/g0rx/CVE-2018-7600-Drupal-RCE","label":"github.com/g0rx/CVE-2018-7600-Drupal-RCE","hostname":"github.com","tags":["X Refsource MISC","Patch","Third Party Advisory"]},{"url":"http://www.securitytracker.com/id/1040598","label":"www.securitytracker.com/id/1040598","hostname":"www.securitytracker.com","tags":["VDB Entry","X Refsource SECTRACK","Broken Link","Third Party Advisory"]},{"url":"https://twitter.com/arancaytar/status/979090719003627521","label":"twitter.com/arancaytar/status/979090719003627521","hostname":"twitter.com","tags":["X Refsource MISC","Third Party Advisory"]},{"url":"https://twitter.com/RicterZ/status/979567469726613504","label":"twitter.com/RicterZ/status/979567469726613504","hostname":"twitter.com","tags":["X Refsource MISC","Broken Link","Third Party Advisory"]},{"url":"https://www.drupal.org/sa-core-2018-002","label":"www.drupal.org/sa-core-2018-002","hostname":"www.drupal.org","tags":["X Refsource CONFIRM","Vendor Advisory","REPORT"]},{"url":"https://www.synology.com/support/security/Synology_SA_18_17","label":"www.synology.com/support/security/Synology_SA_18_17","hostname":"www.synology.com","tags":["X Refsource CONFIRM","Third Party Advisory"]},{"url":"https://github.com/a2u/CVE-2018-7600","label":"github.com/a2u/CVE-2018-7600","hostname":"github.com","tags":["X Refsource MISC","Third Party Advisory"]},{"url":"https://www.exploit-db.com/exploits/44482/","label":"www.exploit-db.com/exploits/44482/","hostname":"www.exploit-db.com","tags":["Exploit","X Refsource EXPLOIT DB","Third Party Advisory","VDB Entry"]},{"url":"https://research.checkpoint.com/uncovering-drupalgeddon-2/","label":"research.checkpoint.com/uncovering-drupalgeddon-2/","hostname":"research.checkpoint.com","tags":["X Refsource MISC","Exploit","Third Party Advisory"]},{"url":"https://groups.drupal.org/security/faq-2018-002","label":"groups.drupal.org/security/faq-2018-002","hostname":"groups.drupal.org","tags":["X Refsource CONFIRM","Vendor Advisory","REPORT"]},{"url":"https://www.debian.org/security/2018/dsa-4156","label":"www.debian.org/security/2018/dsa-4156","hostname":"www.debian.org","tags":["Vendor Advisory","X Refsource DEBIAN","Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/03/msg00028.html","label":"lists.debian.org/debian-lts-announce/2018/03/msg00028.html","hostname":"lists.debian.org","tags":["Mailing List","X Refsource MLIST","Third Party Advisory"]},{"url":"https://www.exploit-db.com/exploits/44448/","label":"www.exploit-db.com/exploits/44448/","hostname":"www.exploit-db.com","tags":["Exploit","X Refsource EXPLOIT DB","Third Party Advisory","VDB Entry"]},{"url":"http://www.securityfocus.com/bid/103534","label":"www.securityfocus.com/bid/103534","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID","Broken Link","Third Party Advisory"]},{"url":"https://badpackets.net/over-100000-drupal-websites-vulnerable-to-drupalgeddon-2-cve-2018-7600/","label":"badpackets.net/over-100000-drupal-websites-vulnerable-to-drupalgeddon-2-cve-2018-7600/","hostname":"badpackets.net","tags":["X Refsource MISC","Broken Link","Third Party Advisory"]},{"url":"https://greysec.net/showthread.php?tid=2912&pid=10561","label":"greysec.net/showthread.php?tid=2912&pid=10561","hostname":"greysec.net","tags":["X Refsource MISC","Broken Link","Issue Tracking","Third Party Advisory"]},{"url":"https://blog.appsecco.com/remote-code-execution-with-drupal-core-sa-core-2018-002-95e6ecc0c714","label":"blog.appsecco.com/remote-code-execution-with-drupal-core-sa-core-2018-002-95e6ecc0c714","hostname":"blog.appsecco.com","tags":["X Refsource MISC","Third Party Advisory"]},{"url":"https://www.tenable.com/blog/critical-drupal-core-vulnerability-what-you-need-to-know","label":"www.tenable.com/blog/critical-drupal-core-vulnerability-what-you-need-to-know","hostname":"www.tenable.com","tags":["X Refsource MISC","Third Party Advisory"]},{"url":"https://twitter.com/RicterZ/status/984495201354854401","label":"twitter.com/RicterZ/status/984495201354854401","hostname":"twitter.com","tags":["X Refsource MISC","Broken Link","Third Party Advisory"]},{"url":"https://www.exploit-db.com/exploits/44449/","label":"www.exploit-db.com/exploits/44449/","hostname":"www.exploit-db.com","tags":["Exploit","X Refsource EXPLOIT DB","Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-7600","label":"www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-7600","hostname":"www.cisa.gov","tags":["Government Resource","US Government Resource"]},{"url":"https://ubuntu.com/security/CVE-2018-7600","label":"ubuntu.com/security/CVE-2018-7600","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://www.drupal.org/psa-2018-001","label":"www.drupal.org/psa-2018-001","hostname":"www.drupal.org","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-7600","label":"www.cve.org/CVERecord?id=CVE-2018-7600","hostname":"www.cve.org","tags":["REPORT"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","label":"www.cisa.gov/known-exploited-vulnerabilities-catalog","hostname":"www.cisa.gov","tags":["REPORT"]},{"url":"https://ubuntu.com/security/notices/USN-4773-1","label":"ubuntu.com/security/notices/USN-4773-1","hostname":"ubuntu.com","tags":["Advisory"]}],"lineage":{"upstream":[],"downstream":["USN-4773-1"],"duplicates":[],"related":["USN-4773-1"]},"timeline":[{"kind":"published","date":"2018-03-29T07:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"kev-added","date":"2021-11-03T00:00:00.000Z","label":"Added to CISA KEV","detail":"Drupal Core Remote Code Execution Vulnerability","source":"cisa"},{"kind":"kev-due","date":"2022-05-03T00:00:00.000Z","label":"CISA remediation due","detail":"Apply updates per vendor instructions.","source":"cisa"},{"kind":"modified","date":"2025-10-21T23:45:52.444Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":90,"level":"critical","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T14:40:09.168Z","stale":false,"partial":false}}