---
id: "CVE-2026-96376"
kind: "vulnerability"
aliases: ["CVE-2026-96376"]
title: "Drupal Cloud: OS command injection in versions up to 7.0.1"
severity: "medium"
cvss: 6.4
epss: 0.00573
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["drupal", "drupal-cloud", "runtime", "self-hosted"]
not_affected_if: []
published_at: "2026-10-22T02:17:07+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-25T03:59:19+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96376", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-96376", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# Drupal Cloud: OS command injection in versions up to 7.0.1

Drupal Cloud has an OS command injection flaw affecting versions from 0.0.0 through 7.0.1. An attacker who can reach the affected feature could pass input that the server runs as a shell command.

_Summary, check and fix written by a model from the sources; labelled as such._

## Fix

- Upgrade Drupal Cloud past `7.0.1`, once a fixed version is confirmed by the vendor

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-96376
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-96376

## From the sources

Improper Neutralization of Special Elements used in an OS Command ("OS Command Injection") vulnerability in Drupal Cloud allows OS Command Injection. This issue affects Cloud versions: from 0.0.0 to 7.0.1.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_