CVE-2026-96376
CVE-2026-96376 · Cloud - Critical - Remote code execution - SA-CONTRIB-2026-177
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Improper Neutralization of Special Elements used in an OS Command ("OS Command Injection") vulnerability in Drupal Cloud allows OS Command Injection. This issue affects Cloud versions: from 0.0.0 to 7.0.1.
CVSS 6.4 · Medium · EPSS 0.6% · Fix available
- Published
- Updated
Stack: php
Affected products and versions
cloud
- Versions
- ≥ 0.0.0, < 7.0.1: Affected (semver)
Update to 7.0.1
drupal/cloud Packagist:https://packages.drupal.org/8
- Affected ranges
- ECOSYSTEM: < 7.0.1
Update to 7.0.1