Packagist/drupal/core CVE-2018-7600: unknown, exploited, EPSS 99.99%

A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result

Action: Upgrade drupal/core to 8.3.9 or later.

composer require drupal/core:8.3.9

composer require drupal/core:8.4.6

composer require drupal/core:8.5.1

Affected

introduced	fixed	last affected
8.0.0	8.3.9	-
8.4.0	8.4.6	-
8.5.0	8.5.1	-

Fixed versions

8.3.9

8.4.6

8.5.1

Sources

osv: DRUPAL-CORE-2018-002
kev: CVE-2018-7600
https://www.drupal.org/sa-core-2018-002

CVE-2018-7600 · published 2018-03-28T18:14:10Z · modified 2025-12-10T23:41:01.770409Z · JSON