CVE-2015-8761: The Values module 7.x-1.x before 7.x-1.2 for Drupal does not properly check permissions, which allows remot...

Security readout for executives and security teams

This issue affects Drupal sites using the Values module 7.x-1.x before 7.x-1.2. A user who already has the "Import value sets" permission could use the module's import path to run arbitrary PHP code. Risk is highest where that permission is broadly granted or delegated to semi-trusted administrators. Exposure appears limited to Drupal 7 sites running Values module 7.x-1.x before 7.x-1.2, especially where non-core or delegated admin roles have "Import value sets" permission. Prioritize affected Drupal systems where the module is installed and admin permissions are delegated. This is not documented as actively exploited in the provided sources, but arbitrary PHP execution makes verified exposure worth prompt remediation. Mitigation focus: Upgrade the Drupal Values module to 7.x-1.2 or later.; Review who has the "Import value sets" permission.; Remove that permission from roles that do not strictly need it..

Prepared

Jun 13, 2026, 21:26 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.