Every CVE Search/ Get API key

CVE-2018-7600

Drupal Core Remote Code Execution Vulnerability

9.8 CriticalIn KEVPublic exploitFix available

Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

100.0%Up 23.4 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 9.8

Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.

Record
CVE-2018-7600
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-20
Updated
2026-11-02
CVE List 9.8

Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.

Record
CVE-2018-7600
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-20
Updated
2026-11-02
EUVDEUVD-2022-2985 9.8

Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.

Record
EUVD-2022-2985
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-7fh9-933g-885p 9.8

Drupal Core Remote Code Execution Vulnerability

Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.

Record
GHSA-7fh9-933g-885p
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
Weakness
CWE-20
Updated
2026-11-02
CISA KEV No score

Drupal Core Remote Code Execution Vulnerability

Drupal Core contains a remote code execution vulnerability that could allow an attacker to exploit multiple attack vectors on a Drupal site, resulting in complete site compromise.

Record
CVE-2018-7600
Weakness
CWE-20
Updated
2026-11-02
OSVALPINE-CVE-2018-7600 9.8

Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.

Record
ALPINE-CVE-2018-7600
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-03
Show 5 moreShow less
OSV 9.8

Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.

Record
CVE-2018-7600
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVGHSA-7fh9-933g-885p 9.8

Drupal Core Remote Code Execution Vulnerability

Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.

Record
GHSA-7fh9-933g-885p
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
Weakness
CWE-20
Updated
2026-11-02
OSVUBUNTU-CVE-2018-7600 9.8

Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.

Record
UBUNTU-CVE-2018-7600
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDRUPAL-CORE-2018-002 No score

A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being completely compromised.

The security team has written an FAQ about this issue.

Edited 2020, February 13 to fix links to patch files.

Record
DRUPAL-CORE-2018-002
Updated
2026-11-02
OSVUSN-4773-1 No score

drupal7 vulnerabilities

It was discovered that Drupal did not properly process certain input. An attacker could use this vulnerability to execute arbitrary code or completely compromise a Drupal site. (CVE-2018-7600, CVE-2018-7602)

It was discovered that password reset URLs in Drupal could be forged. An attacker could use this vulnerability to gain access to another user's account. This issue affected only Ubuntu 14.04 ESM. (CVE-2015-2559)

It was discovered that Drupal did not properly protect against open redirects. An attacker could use this vulnerability to send unsuspecting users to 3rd party sites and potentially carry out phishing attacks. This issue affected only Ubuntu 14.04 ESM. (CVE-2015-2749, CVE-2015-2750)

Record
USN-4773-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
drupal/core
Packagist
 7.0 up to 7.58
7.58
drupal/core
Packagist
 8.0 up to 8.3.9
8.3.9
drupal/core
Packagist
 8.4.0 up to 8.4.6
8.4.6
drupal/core
Packagist
 8.5.0 up to 8.5.1
8.5.1
drupal/drupal
Packagist
 7.0 up to 7.58
7.58
drupal/drupal
Packagist
 8.0 up to 8.3.9
8.3.9
drupal/drupal
Packagist
 8.4 up to 8.4.6
8.4.6
drupal/drupal
Packagist
 8.5 up to 8.5.1
8.5.1
drupal7
Alpine:v3.10
 before 7.58-r0
7.58-r0
drupal7
Alpine:v3.11
 before 7.58-r0
7.58-r0
Show 26 moreShow less
Affected packages
PackageAffectedFixed
drupal7
Alpine:v3.12
 before 7.58-r0
7.58-r0
drupal7
Alpine:v3.13
 before 7.58-r0
7.58-r0
drupal7
Alpine:v3.14
 before 7.58-r0
7.58-r0
drupal7
Alpine:v3.15
 before 7.58-r0
7.58-r0
drupal7
Alpine:v3.16
 before 7.58-r0
7.58-r0
drupal7
Alpine:v3.17
 before 7.58-r0
7.58-r0
drupal7
Alpine:v3.18
 before 7.58-r0
7.58-r0
drupal7
Alpine:v3.19
 before 7.58-r0
7.58-r0
drupal7
Alpine:v3.20
 before 7.58-r0
7.58-r0
drupal7
Alpine:v3.6
 before 7.58-r0
7.58-r0
drupal7
Alpine:v3.7
 before 7.58-r0
7.58-r0
drupal7
Alpine:v3.8
 before 7.58-r0
7.58-r0
drupal7
Alpine:v3.9
 before 7.58-r0
7.58-r0
drupal7
Debian:7
 before 7.14-2+deb7u18, plus listed versions
7.14-27.14-2+deb7u17.14-2+deb7u107.14-2+deb7u10~bpo60+17.14-2+deb7u11
Show 21 moreShow less
7.14-2+deb7u11~bpo60+17.14-2+deb7u127.14-2+deb7u137.14-2+deb7u147.14-2+deb7u157.14-2+deb7u167.14-2+deb7u177.14-2+deb7u1~bpo60+17.14-2+deb7u27.14-2+deb7u2~bpo60+17.14-2+deb7u37.14-2+deb7u47.14-2+deb7u4~bpo60+17.14-2+deb7u57.14-2+deb7u67.14-2+deb7u6~bpo60+17.14-2+deb7u77.14-2+deb7u7~bpo60+17.14-2+deb7u87.14-2+deb7u97.14-2+deb7u9~bpo60+1
7.14-2+deb7u18
drupal/core
Packagist
 8.0.0 up to 8.3.9, 8.4.0 up to 8.4.6, 8.5.0 up to 8.5.1, plus listed versions
8.0.18.0.28.0.38.0.48.0.5
Show 45 moreShow less
8.0.68.1.08.1.0-beta18.1.0-beta28.1.0-rc18.1.18.1.108.1.28.1.38.1.48.1.58.1.68.1.78.1.88.1.98.2.08.2.0-beta18.2.0-beta28.2.0-beta38.2.0-rc18.2.0-rc28.2.18.2.28.2.38.2.48.2.58.2.68.2.78.2.88.3.08.3.0-alpha18.3.0-beta18.3.0-rc18.3.0-rc28.3.18.3.28.3.38.3.48.3.58.3.68.3.78.3.88.4.18.4.28.4.3
8.3.98.4.68.5.1
drupal7
Debian:8
 before 7.32-1+deb8u11, plus listed versions
7.32-1+deb8u107.32-1+deb8u37.32-1+deb8u47.32-1+deb8u4~bpo70+17.32-1+deb8u5
Show 5 moreShow less
7.32-1+deb8u5~bpo70+17.32-1+deb8u67.32-1+deb8u77.32-1+deb8u87.32-1+deb8u9
7.32-1+deb8u11
drupal7
Debian:9
 before 7.52-2+deb9u3, plus listed versions
7.52-27.52-2+deb9u17.52-2+deb9u2
7.52-2+deb9u3
drupal/core
Packagist
 8.0 up to 8.3.9, plus listed versions
8.0.08.0.0-beta108.0.0-beta118.0.0-beta128.0.0-beta13
Show 45 moreShow less
8.0.0-beta148.0.0-beta158.0.0-beta168.0.0-beta68.0.0-beta78.0.0-beta88.0.0-beta98.0.0-rc18.0.0-rc28.0.0-rc38.0.0-rc48.0.18.0.28.0.38.0.48.0.58.0.68.1.08.1.0-beta18.1.0-beta28.1.0-rc18.1.18.1.108.1.28.1.38.1.48.1.58.1.68.1.78.1.88.1.98.2.08.2.0-beta18.2.0-beta28.2.0-beta38.2.0-rc18.2.0-rc28.2.18.2.28.2.38.2.48.2.58.2.68.2.78.2.8
8.3.9
drupal/core
Packagist
 8.4.0 up to 8.4.6, plus listed versions
8.4.18.4.28.4.38.4.48.4.5
8.4.6
drupal/drupal
Packagist
 8.0 up to 8.3.9, plus listed versions
8.0.08.0.0-alpha148.0.0-alpha158.0.0-beta18.0.0-beta10
Show 45 moreShow less
8.0.0-beta118.0.0-beta128.0.0-beta138.0.0-beta148.0.0-beta158.0.0-beta168.0.0-beta28.0.0-beta38.0.0-beta48.0.0-beta58.0.0-beta68.0.0-beta78.0.0-beta98.0.0-rc18.0.0-rc28.0.0-rc38.0.0-rc48.0.18.0.28.0.38.0.48.0.58.0.68.1.08.1.0-beta18.1.0-beta28.1.0-rc18.1.18.1.108.1.28.1.38.1.48.1.58.1.68.1.78.1.88.1.98.2.08.2.0-beta18.2.0-beta28.2.0-beta38.2.0-rc18.2.0-rc28.2.18.2.2
8.3.9
drupal/drupal
Packagist
 8.4 up to 8.4.6, plus listed versions
8.4.08.4.0-alpha18.4.0-beta18.4.0-rc18.4.0-rc2
Show 5 moreShow less
8.4.18.4.28.4.38.4.48.4.5
8.4.6
drupal/drupal
Packagist
 8.5 up to 8.5.1, plus listed versions
8.5.08.5.0-alpha18.5.0-beta18.5.0-rc1
8.5.1
drupal7
Ubuntu:Pro:14.04:LTS
 before 7.26-1ubuntu0.1+esm1, plus listed versions
7.23-17.24-17.24-27.26-17.26-1ubuntu0.1
7.26-1ubuntu0.1+esm1
drupal7
Ubuntu:Pro:16.04:LTS
 before 7.44-1ubuntu1~16.04.0+esm1, plus listed versions
7.38-17.41-17.44-1ubuntu1~16.04.0
7.44-1ubuntu1~16.04.0+esm1
drupal7
Ubuntu:Pro:14.04:LTS
From an advisory covering 5 CVEs
 before 7.26-1ubuntu0.1+esm1, plus listed versions
7.23-17.24-17.24-27.26-17.26-1ubuntu0.1
7.26-1ubuntu0.1+esm1
drupal7
Ubuntu:Pro:16.04:LTS
From an advisory covering 5 CVEs
 before 7.44-1ubuntu1~16.04.0+esm1, plus listed versions
7.38-17.41-17.44-1ubuntu1~16.04.0
7.44-1ubuntu1~16.04.0+esm1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
MetasploitDrupal Drupalgeddon 2 Forms API Property Injection2018-03-28
PoC in GitHuba2u/CVE-2018-76002018-03-30
PoC in GitHubg0rx/CVE-2018-7600-Drupal-RCE2018-03-30
PoC in GitHubdreadlocked/Drupalgeddon22018-04-12
Exploit-DBDrupal < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution (PoC)2018-04-13
Exploit-DBDrupal < 7.58 / < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution2018-04-13
PoC in GitHubknqyf263/CVE-2018-76002018-04-13
PoC in GitHubdr-iman/CVE-2018-7600-Drupal-0day-RCE2018-04-14
PoC in GitHubdwisiswant0/CVE-2018-76002018-04-14
PoC in GitHubjirojo2/drupalgeddon22018-04-14
Show 20 moreShow less
Public exploits
SourceLinkDate
PoC in GitHubsl4cky/CVE-2018-76002018-04-15
PoC in GitHubsl4cky/CVE-2018-7600-Masschecker2018-04-15
PoC in GitHubthehappydinoa/CVE-2018-76002018-04-15
PoC in GitHubfirefart/CVE-2018-76002018-04-16
Exploit-DBDrupal < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution (Metasploit)2018-04-17
PoC in GitHubpimps/CVE-2018-76002018-04-17
PoC in GitHublorddemon/drupalgeddon22018-04-19
PoC in GitHubHestat/drupal-check2018-04-24
PoC in GitHubDamian972/drupalgeddon-22018-05-01
PoC in GitHubsoch4n/CVE-2018-76002018-05-25
PoC in GitHubhappynote3966/CVE-2018-76002018-07-12
PoC in GitHubshellord/CVE-2018-7600-Drupal-RCE2018-10-02
PoC in GitHubr3dxpl0it/CVE-2018-76002018-10-23
PoC in GitHubcved-sources/cve-2018-76002019-01-06
PoC in GitHubmadneal/codeql-scanner2019-03-15
PoC in GitHubdrugeddon/drupal-exploit2019-03-24
PoC in GitHubshellord/Drupalgeddon-Mass-Exploiter2019-10-10
PoC in GitHubzhzyker/CVE-2018-7600-Drupal-POC-EXP2020-04-07
PoC in GitHubrabbitmask/CVE-2018-7600-Drupal72020-04-12
NucleiDrupal - Remote Code Execution

Plus 31 more. The full list has every link.

History

History
RecordedChangedSources
affected
exploitation
affected, aliases, referencesOSV
exploits, exploits_more
exploits
first indexedCVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-7600 is a critical vulnerability (CVSS 9.8) in Drupal, published March 28, 2018. CISA lists it as known to be exploited, since November 3, 2021. EUVD reports exploitation since November 3, 2021. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 100.0%, the 99th percentile. Fixed in drupal/core 7.58.

References

Show 30 moreShow less
This page doesn't list everything

Left out here: 34 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open