Improper neutralization of special elements used in an SQL command was identified in Drupal core, allowing an attacker to inject arbitrary SQL statements through unvalidated user input. The flaw can be exploited by manipulating inputs that are incorporated directly into database queries, exposing the database to unintended commands. This vulnerability is a classic example of CWE‑89 (SQL Injection).

Drupal core versions affected include 8.9.0 through just before 10.4.10, 10.5.0 through just before 10.5.10, 10.6.0 through just before 10.6.9, 11.0.0 through just before 11.1.10, 11.2.0 through just before 11.2.12, and 11.3.0 through just before 11.3.10.

The CVSS score of 9.8 indicates high severity. The EPSS score of 10% indicates a moderate probability of exploitation, and the vulnerability is listed in KEV. Based on the description, the likely attack vector is remote via web input where sufficient privileges are granted in the Drupal application. Exploitation would involve submitting crafted input that bypasses proper escaping in SQL queries without additional authentication or configuration steps.