PT-2026-44164 · Drupal · Basket

Dave Long + 3 · CVE-2026-9726 · Published 2026-05-27 · Updated 2026-07-10

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Basket versions prior to 2.1.17

Description The Basket module, which provides e-commerce and checkout functionality for Drupal sites, fails to sufficiently sanitize user-supplied data before it is processed by the PHP unserialize() function. This allows an attacker to provide a crafted payload to trigger PHP Object Injection, a process where untrusted data is used to instantiate objects. If a viable gadget chain—a sequence of existing code fragments—is present in the site codebase or dependencies, this can lead to arbitrary PHP code execution.

Recommendations Update to version 2.1.17.

Exploit

Fix

Weakness Enumeration

CWE-915

Related Identifiers

CVE-2026-9726

DRUPAL-CONTRIB-2026-038

Affected Products

Basket

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/9xxx/CVE-2026-9726.json · Exploit
• https://osv.dev/vulnerability/DRUPAL-CONTRIB-2026-038 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-9726 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-9726 · Security Note
• https://git.drupalcode.org/project/basket · Note
• https://drupal.org/project/basket · Note
• https://drupal.org/sa-contrib-2026-038 · Note
• https://twitter.com/thedroptimes/status/2061839754430226544 · Twitter Post