#drupal

Analysis · May 20, 2026 · Colten Anderson

Drupalgeddon: when a data structure is allowed to name a function to call

Drupal's Form API lets a renderable array carry a callback, that's a feature. Drupalgeddon (CVE-2018-7602) let an attacker put their own callback in, and Drupal called it: exec, passthru, system. Powerful framework metaprogramming plus untrusted input equals RCE.