Description
A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002. Both SA-CORE-2018-002 and this vulnerability are being exploited in the wild.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Drupal | core | unspecified – < 7.59, unspecified – < 8.5.3, unspecified – < 8.4.8 | 7.59 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 9 | drupal7 | 7.52-2+deb9u4 | DSA-4180-1 |
| Debian 8 | drupal7 | 7.32-1+deb8u12 | DSA-4180-1 |
| Debian 7 | drupal7 | 7.14-2+deb7u19 | DLA-1365-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | drupal7 | 7.44-1ubuntu1~16.04.0+esm1 | USN-4773-1 |
| Ubuntu Pro 14.04 LTS | drupal7 | 7.26-1ubuntu0.1+esm1 | USN-4773-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.20 | drupal7 | 7.59-r0 | — |
| Alpine v3.19 | drupal7 | 7.59-r0 | — |
| Alpine v3.18 | drupal7 | 7.59-r0 | — |
| Alpine v3.17 | drupal7 | 7.59-r0 | — |
| Alpine v3.16 | drupal7 | 7.59-r0 | — |
Show 10 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.15 | drupal7 | 7.59-r0 | — |
| Alpine v3.14 | drupal7 | 7.59-r0 | — |
| Alpine v3.13 | drupal7 | 7.59-r0 | — |
| Alpine v3.12 | drupal7 | 7.59-r0 | — |
| Alpine v3.11 | drupal7 | 7.59-r0 | — |
| Alpine v3.10 | drupal7 | 7.59-r0 | — |
| Alpine v3.9 | drupal7 | 7.59-r0 | — |
| Alpine v3.8 | drupal7 | 7.59-r0 | — |
| Alpine v3.7 | drupal7 | 7.59-r0 | — |
| Alpine v3.6 | drupal7 | 7.59-r0 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 2
- Drupal < 7.58 - 'Drupalgeddon3' (Authenticated) Remote Code (Metasploit) EDB-44557 · webapps · Apr 30, 2018 · verified
- Drupal < 7.58 - 'Drupalgeddon3' (Authenticated) Remote Code Execution (PoC) EDB-44542 · webapps · Apr 25, 2018 · verified
GitHub 6 repositories
-
1337g/Drupalgedon3 ★ 6 · Apr 27, 2018
POC to test/exploit drupal vulnerability SA-CORE-2018-004 / CVE-2018-7602
-
d4ytox/CVE-2018-7602 ★ 1 · Nov 10, 2026
Drupalgeddon 3: authenticated RCE in Drupal 7 < 7.59 via the destination parameter on any confirm form. User-cancel and node-delete vectors, credentials or a pasted session cookie, and a per-step tra…
-
cyberharsh/DrupalCVE-2018-7602 ★ 1 · Jun 25, 2020
-
kastellanos/CVE-2018-7602 ★ 1 · Oct 29, 2018
-
132231g/CVE-2018-7602 ★ 0 · Feb 18, 2024
-
happynote3966/CVE-2018-7602 ★ 0 · Jul 12, 2018
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Drupal - Remote Code Execution http/cves/2018/CVE-2018-7602.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | drupal/core | >= 8.0.0, < 8.4.8 · >= 8.5.0, < 8.5.3 | 8.4.8, 8.5.3 | DRUPAL-CORE-2018-004 |
| Packagist | drupal/core | >= 7.0, < 7.59 | 7.59 | GHSA-297x-j9pm-xjgg |
| Packagist | drupal/core | >= 8.0, < 8.4.8 | 8.4.8 | GHSA-297x-j9pm-xjgg |
| Packagist | drupal/core | >= 8.5, < 8.5.3 | 8.5.3 | GHSA-297x-j9pm-xjgg |
| Packagist | drupal/drupal | >= 7.0, < 7.59 | 7.59 | GHSA-297x-j9pm-xjgg |
| Packagist | drupal/drupal | >= 8.0, < 8.4.8 | 8.4.8 | GHSA-297x-j9pm-xjgg |
| Packagist | drupal/drupal | >= 8.5, < 8.5.3 | 8.5.3 | GHSA-297x-j9pm-xjgg |
Advisories 3
- USN-4773-1 drupal7 vulnerabilities Ubuntu Security Notices (USN) · Oct 27, 2026
- DSA-4180-1 drupal7 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-1365-1 drupal7 - security update Debian Security (DSA / DLA) · Mar 9, 2026
References
- 44557 exploit
- 1040754 vdb-entry
- [debian-lts-announce] 20180426 [SECURITY] [DLA 1365-1] drupal7 security update mailing-list
- 44542 exploit
- DSA-4180 vendor-advisory
- https://www.drupal.org/sa-core-2018-004
- 103985 vdb-entry