klausi#Drupal core - Highly critical - SQL injection - SA-CORE-2026-004
Only affects Drupal sites that use Postgresql (5% of sites estimated by the security team)
Drupal core - Highly critical - SQL injection - SA-CORE-2026-004
Drupal core includes a database abstraction API to ensure that queries executed against the database are sanitized to prevent SQL injection attacks. A vulnerability in this API allows an attacker to send specially crafted requests, resulting in arbitrary SQL injection for sites using PostgreSQL databases. This can lead to information disclosure, and in some cases privilege