Drupal Admins Scramble to Patch Critical SQL Injection Vulnerability Drupal has issued an urgent security update to address a maximum-severity SQL injection vulnerability in its core database abstraction API, which could allow attackers to execute arbitrary SQL queries on websites using PostgreSQL databases. The flaw, if exploited, may lead to information disclosure, privilege escalation, or remote code execution (RCE). The vulnerability affects all supported Drupal branches (11.3, 11.2, 10.6, and 10.5), with patches released on May 20. However, unsupported versions (below 11.1.x, 11.0.x, and 10.4.x) will receive best-effort patches, though Drupal strongly recommends upgrading to a supported release. Admins using Drupal 9.5 or 8.9 can apply manual patches, but migration to a modern version is advised. The issue stems from insufficient input sanitization in Drupal’s database API, enabling attackers to craft malicious queries. While the flaw primarily impacts PostgreSQL-based sites, the update also includes fixes for Symfony (PHP framework) and Twig (template engine), which may have upstream vulnerabilities. Twig was updated to version 3.26.0, and Symfony received critical patches. Security experts warn that exploitation could occur rapidly, as the Drupal Security Team had pre-announced the patch to allow admins time to prepare. Sites using the Drupal Steward web application firewall are temporarily protected but should still upgrade to mitigate potential new attack vectors. Admins are urged to review PostgreSQL and firewall logs for suspicious activity and restrict Twig template access to trusted users. The incident highlights ongoing challenges with SQL injection vulnerabilities, which security professionals argue should no longer persist in modern applications.