CVEvulnerability

CVE-2023-31250

6.5 MEDIUM Published 2023-04-26 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2023-04-26
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-863

Description

The file download facility doesn't sufficiently sanitize file paths in certain situations. This may result in users gaining access to private files that they should not have access to. Some sites may require configuration changes following this security release. Review the release notes for your Drupal version if you have issues accessing private files after updating.

Affected configurations

• drupal drupal (>= 7.0 < 7.96) • drupal drupal (>= 9.4 < 9.4.14) • drupal drupal (>= 9.5 < 9.5.8) • drupal drupal (>= 10.0 < 10.0.8)

Related

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References