vaibhav91one/drupalgeddon2-cve-labIntentionally vulnerable Drupal 7.57 lab for reproducing CVE-2018-7600 (Drupalgeddon2) in a Docker container, with an installer script and PHP built-in server for isolated security testing.
This repository is a reusable target package for the Drupalgeddon2 run.
Sentinel reproduced CVE-2018-7600 on 2026-08-27 against Drupal core 7.57 with SQLite and PHP 7.4. The exploit is the Drupal 7 two-request AJAX render-array path:
name[#post_render][]=passthru,
name[#markup]=id, and name[#type]=markupform_build_id to /?q=file/ajax/name/#value/<form_build_id>This repository keeps a Docker-based lab bootstrap so BountyDesk can treat the scenario as a connected GitHub target. The Docker image builds Drupal 7.57 on PHP 7.4 and runs an installer script before starting PHP's built-in server.
This is an intentionally vulnerable lab. Run it only in an isolated local or sandbox environment.
docker build -t drupalgeddon2-cve-lab .
docker run --rm -p 8080:8080 drupalgeddon2-cve-lab
The target listens on HTTP port 8080.
BountyDesk should treat this repository as target code only. The TrueForge
agent must investigate the running target through the platform harness, using
probe_target for read-only requests and probe_target_write for any
state-changing request that needs approval. No script in this repository is an
authoritative verdict source.
Evidence source: demo/evidence/drupalgeddon2-cve-2018-7600-blind-build.md in the Sentinel repo.