CVE-2018-7600

Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.

• CWE-20
• CWE-20

• http://www.securityfocus.com/bid/103534Broken Link, Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1040598Broken Link, Third Party Advisory, VDB Entry
• https://badpackets.net/over-100000-drupal-websites-vulnerable-to-drupalgeddon-2-cve-2018-7600/Broken Link, Third Party Advisory
• https://blog.appsecco.com/remote-code-execution-with-drupal-core-sa-core-2018-002-95e6ecc0c714Third Party Advisory
• https://github.com/a2u/CVE-2018-7600Third Party Advisory
• https://github.com/g0rx/CVE-2018-7600-Drupal-RCEPatch, Third Party Advisory
• https://greysec.net/showthread.php?tid=2912&pid=10561Broken Link, Issue Tracking, Third Party Advisory
• https://groups.drupal.org/security/faq-2018-002Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2018/03/msg00028.htmlThird Party Advisory
• https://research.checkpoint.com/uncovering-drupalgeddon-2/Exploit, Third Party Advisory
• https://twitter.com/RicterZ/status/979567469726613504Broken Link, Third Party Advisory
• https://twitter.com/RicterZ/status/984495201354854401Broken Link, Third Party Advisory
• https://twitter.com/arancaytar/status/979090719003627521Third Party Advisory
• https://www.debian.org/security/2018/dsa-4156Third Party Advisory
• https://www.drupal.org/sa-core-2018-002Vendor Advisory
• https://www.exploit-db.com/exploits/44448/Exploit, Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/44449/Exploit, Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/44482/Exploit, Third Party Advisory, VDB Entry
• https://www.synology.com/support/security/Synology_SA_18_17Third Party Advisory
• https://www.tenable.com/blog/critical-drupal-core-vulnerability-what-you-need-to-knowThird Party Advisory
• http://www.securityfocus.com/bid/103534Broken Link, Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1040598Broken Link, Third Party Advisory, VDB Entry
• https://badpackets.net/over-100000-drupal-websites-vulnerable-to-drupalgeddon-2-cve-2018-7600/Broken Link, Third Party Advisory
• https://blog.appsecco.com/remote-code-execution-with-drupal-core-sa-core-2018-002-95e6ecc0c714Third Party Advisory
• https://github.com/a2u/CVE-2018-7600Third Party Advisory
• https://github.com/g0rx/CVE-2018-7600-Drupal-RCEPatch, Third Party Advisory
• https://greysec.net/showthread.php?tid=2912&pid=10561Broken Link, Issue Tracking, Third Party Advisory
• https://groups.drupal.org/security/faq-2018-002Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2018/03/msg00028.htmlThird Party Advisory
• https://research.checkpoint.com/uncovering-drupalgeddon-2/Exploit, Third Party Advisory
• https://twitter.com/RicterZ/status/979567469726613504Broken Link, Third Party Advisory
• https://twitter.com/RicterZ/status/984495201354854401Broken Link, Third Party Advisory
• https://twitter.com/arancaytar/status/979090719003627521Third Party Advisory
• https://www.debian.org/security/2018/dsa-4156Third Party Advisory
• https://www.drupal.org/sa-core-2018-002Vendor Advisory
• https://www.exploit-db.com/exploits/44448/Exploit, Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/44449/Exploit, Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/44482/Exploit, Third Party Advisory, VDB Entry
• https://www.synology.com/support/security/Synology_SA_18_17Third Party Advisory
• https://www.tenable.com/blog/critical-drupal-core-vulnerability-what-you-need-to-knowThird Party Advisory
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-7600US Government Resource

Published

Mar 29, 2018

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-7584In PHP through 5.6.33, 7.0.x before 7.0.28, 7.1.x through 7.…
• CVE-2018-7586In the nextgen-gallery plugin before 2.2.50 for WordPress, g…
• CVE-2018-7587An issue was discovered in CImg v.220. DoS occurs when loadi…
• CVE-2018-7588An issue was discovered in CImg v.220. A heap-based buffer o…
• CVE-2018-7589An issue was discovered in CImg v.220. A double free in load…
• CVE-2018-7590CSRF exists in Hoosk 1.7.0 via /admin/users/new/add, resulti…
• CVE-2018-7602A remote code execution vulnerability exists within multiple…9.8
• CVE-2018-7603In Drupal's 3rd party module search auto complete prior to v…
• CVE-2018-7631Buffer Overflow in httpd in EpiCentro E_7.3.2+ allows attack…
• CVE-2018-7632Buffer Overflow in httpd in EpiCentro E_7.3.2+ allows attack…
• CVE-2018-7633Code injection in the /ui/login form Language parameter in E…
• CVE-2018-7634An issue was discovered in Enalean Tuleap 9.17. Lack of CSRF…