The File module in Drupal 7.x before 7.43 and 8.x before 8.0.4 allows remote…
Priority LOW 38CWE-284Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-284.
Summary
The File module in Drupal 7.x before 7.43 and 8.x before 8.0.4 allows remote authenticated users to bypass access restrictions and read, delete, or substitute a link to a file uploaded to an unprocessed form by leveraging permission to create content or comment and upload files.
Why it matters now
EPSS 0.0159 75th percentileScored 2026-11-07
Fix Fixed drupal/core (Packagist): 7.43, 8.0.4drupal/drupal (Packagist): 8.0.4, 7.43
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | drupal/core (Packagist) | 7.0 to before 7.43 | 7.43 | Patch available | GHSA-w2pj-c8x5-jvg2 |
| — | drupal/core (Packagist) | 8.0 to before 8.0.4 | 8.0.4 | Patch available | GHSA-w2pj-c8x5-jvg2 |
| — | drupal/drupal (Packagist) | 8.0 to before 8.0.4 | 8.0.4 | Patch available | GHSA-w2pj-c8x5-jvg2 |
| — | drupal/drupal (Packagist) | 7.0 to before 7.43 | 7.43 | Patch available | GHSA-w2pj-c8x5-jvg2 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- drupal/core (Packagist) Vendor— Affected 7.0 to before 7.43 Fixed in 7.43 Patch available GHSA-w2pj-c8x5-jvg2
- drupal/core (Packagist) Vendor— Affected 8.0 to before 8.0.4 Fixed in 8.0.4 Patch available GHSA-w2pj-c8x5-jvg2
- drupal/drupal (Packagist) Vendor— Affected 8.0 to before 8.0.4 Fixed in 8.0.4 Patch available GHSA-w2pj-c8x5-jvg2
- drupal/drupal (Packagist) Vendor— Affected 7.0 to before 7.43 Fixed in 7.43 Patch available GHSA-w2pj-c8x5-jvg2
CPE configurations NVD · 63
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:drupal:drupal:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Drupal |
| cpe:2.3:a:drupal:drupal:7.0:alpha1:*:*:*:*:*:* | 7.0 alpha1 | Vulnerable | Drupal |
| cpe:2.3:a:drupal:drupal:7.0:alpha2:*:*:*:*:*:* | 7.0 alpha2 | Vulnerable | Drupal |
| cpe:2.3:a:drupal:drupal:7.0:alpha3:*:*:*:*:*:* | 7.0 alpha3 | Vulnerable | Drupal |
| cpe:2.3:a:drupal:drupal:7.0:alpha4:*:*:*:*:*:* | 7.0 alpha4 | Vulnerable | Drupal |
| cpe:2.3:a:drupal:drupal:7.0:alpha5:*:*:*:*:*:* | 7.0 alpha5 | Vulnerable | Drupal |
| cpe:2.3:a:drupal:drupal:7.0:alpha6:*:*:*:*:*:* | 7.0 alpha6 | Vulnerable | Drupal |
| cpe:2.3:a:drupal:drupal:7.0:alpha7:*:*:*:*:*:* | 7.0 alpha7 | Vulnerable | Drupal |
| cpe:2.3:a:drupal:drupal:7.0:beta1:*:*:*:*:*:* | 7.0 beta1 | Vulnerable | Drupal |
| cpe:2.3:a:drupal:drupal:7.0:beta2:*:*:*:*:*:* | 7.0 beta2 | Vulnerable | Drupal |
- cpe:2.3:a:drupal:drupal:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Drupal
- cpe:2.3:a:drupal:drupal:7.0:alpha1:*:*:*:*:*:* Versions 7.0 alpha1 Vulnerable ·Drupal
- cpe:2.3:a:drupal:drupal:7.0:alpha2:*:*:*:*:*:* Versions 7.0 alpha2 Vulnerable ·Drupal
- cpe:2.3:a:drupal:drupal:7.0:alpha3:*:*:*:*:*:* Versions 7.0 alpha3 Vulnerable ·Drupal
- cpe:2.3:a:drupal:drupal:7.0:alpha4:*:*:*:*:*:* Versions 7.0 alpha4 Vulnerable ·Drupal
- cpe:2.3:a:drupal:drupal:7.0:alpha5:*:*:*:*:*:* Versions 7.0 alpha5 Vulnerable ·Drupal
- cpe:2.3:a:drupal:drupal:7.0:alpha6:*:*:*:*:*:* Versions 7.0 alpha6 Vulnerable ·Drupal
- cpe:2.3:a:drupal:drupal:7.0:alpha7:*:*:*:*:*:* Versions 7.0 alpha7 Vulnerable ·Drupal
- cpe:2.3:a:drupal:drupal:7.0:beta1:*:*:*:*:*:* Versions 7.0 beta1 Vulnerable ·Drupal
- cpe:2.3:a:drupal:drupal:7.0:beta2:*:*:*:*:*:* Versions 7.0 beta2 Vulnerable ·Drupal
Show 53 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:drupal:drupal:7.0:beta3:*:*:*:*:*:* | 7.0 beta3 | Vulnerable | Drupal |
| cpe:2.3:a:drupal:drupal:7.0:dev:*:*:*:*:*:* | 7.0 dev | Vulnerable | Drupal |
| cpe:2.3:a:drupal:drupal:7.0:rc1:*:*:*:*:*:* | 7.0 rc1 | Vulnerable | Drupal |
| cpe:2.3:a:drupal:drupal:7.0:rc2:*:*:*:*:*:* | 7.0 rc2 | Vulnerable | Drupal |
| cpe:2.3:a:drupal:drupal:7.0:rc3:*:*:*:*:*:* | 7.0 rc3 | Vulnerable | Drupal |
| cpe:2.3:a:drupal:drupal:7.0:rc4:*:*:*:*:*:* | 7.0 rc4 | Vulnerable | Drupal |
| cpe:2.3:a:drupal:drupal:7.1:*:*:*:*:*:*:* | 7.1 | Vulnerable | Drupal |
| cpe:2.3:a:drupal:drupal:7.2:*:*:*:*:*:*:* | 7.2 | Vulnerable | Drupal |
| cpe:2.3:a:drupal:drupal:7.3:*:*:*:*:*:*:* | 7.3 | Vulnerable | Drupal |
| cpe:2.3:a:drupal:drupal:7.4:*:*:*:*:*:*:* | 7.4 | Vulnerable | Drupal |
| cpe:2.3:a:drupal:drupal:7.5:*:*:*:*:*:*:* | 7.5 | Vulnerable | Drupal |
| cpe:2.3:a:drupal:drupal:7.6:*:*:*:*:*:*:* | 7.6 | Vulnerable | Drupal |
| cpe:2.3:a:drupal:drupal:7.7:*:*:*:*:*:*:* | 7.7 | Vulnerable | Drupal |
| cpe:2.3:a:drupal:drupal:7.8:*:*:*:*:*:*:* | 7.8 | Vulnerable | Drupal |
| cpe:2.3:a:drupal:drupal:7.9:*:*:*:*:*:*:* | 7.9 | Vulnerable | Drupal |
| cpe:2.3:a:drupal:drupal:7.10:*:*:*:*:*:*:* | 7.10 | Vulnerable | Drupal |
| cpe:2.3:a:drupal:drupal:7.11:*:*:*:*:*:*:* | 7.11 | Vulnerable | Drupal |
| cpe:2.3:a:drupal:drupal:7.12:*:*:*:*:*:*:* | 7.12 | Vulnerable | Drupal |
| cpe:2.3:a:drupal:drupal:7.13:*:*:*:*:*:*:* | 7.13 | Vulnerable | Drupal |
| cpe:2.3:a:drupal:drupal:7.14:*:*:*:*:*:*:* | 7.14 | Vulnerable | Drupal |
| cpe:2.3:a:drupal:drupal:7.15:*:*:*:*:*:*:* | 7.15 | Vulnerable | Drupal |
| cpe:2.3:a:drupal:drupal:7.16:*:*:*:*:*:*:* | 7.16 | Vulnerable | Drupal |
| cpe:2.3:a:drupal:drupal:7.17:*:*:*:*:*:*:* | 7.17 | Vulnerable | Drupal |
| cpe:2.3:a:drupal:drupal:7.18:*:*:*:*:*:*:* | 7.18 | Vulnerable | Drupal |
| cpe:2.3:a:drupal:drupal:7.19:*:*:*:*:*:*:* | 7.19 | Vulnerable | Drupal |
| cpe:2.3:a:drupal:drupal:7.20:*:*:*:*:*:*:* | 7.20 | Vulnerable | Drupal |
| cpe:2.3:a:drupal:drupal:7.21:*:*:*:*:*:*:* | 7.21 | Vulnerable | Drupal |
| cpe:2.3:a:drupal:drupal:7.22:*:*:*:*:*:*:* | 7.22 | Vulnerable | Drupal |
| cpe:2.3:a:drupal:drupal:7.23:*:*:*:*:*:*:* | 7.23 | Vulnerable | Drupal |
| cpe:2.3:a:drupal:drupal:7.24:*:*:*:*:*:*:* | 7.24 | Vulnerable | Drupal |
| cpe:2.3:a:drupal:drupal:7.25:*:*:*:*:*:*:* | 7.25 | Vulnerable | Drupal |
| cpe:2.3:a:drupal:drupal:7.26:*:*:*:*:*:*:* | 7.26 | Vulnerable | Drupal |
| cpe:2.3:a:drupal:drupal:7.27:*:*:*:*:*:*:* | 7.27 | Vulnerable | Drupal |
| cpe:2.3:a:drupal:drupal:7.28:*:*:*:*:*:*:* | 7.28 | Vulnerable | Drupal |
| cpe:2.3:a:drupal:drupal:7.29:*:*:*:*:*:*:* | 7.29 | Vulnerable | Drupal |
| cpe:2.3:a:drupal:drupal:7.30:*:*:*:*:*:*:* | 7.30 | Vulnerable | Drupal |
| cpe:2.3:a:drupal:drupal:7.31:*:*:*:*:*:*:* | 7.31 | Vulnerable | Drupal |
| cpe:2.3:a:drupal:drupal:7.32:*:*:*:*:*:*:* | 7.32 | Vulnerable | Drupal |
| cpe:2.3:a:drupal:drupal:7.33:*:*:*:*:*:*:* | 7.33 | Vulnerable | Drupal |
| cpe:2.3:a:drupal:drupal:7.34:*:*:*:*:*:*:* | 7.34 | Vulnerable | Drupal |
| cpe:2.3:a:drupal:drupal:7.35:*:*:*:*:*:*:* | 7.35 | Vulnerable | Drupal |
| cpe:2.3:a:drupal:drupal:7.36:*:*:*:*:*:*:* | 7.36 | Vulnerable | Drupal |
| cpe:2.3:a:drupal:drupal:7.37:*:*:*:*:*:*:* | 7.37 | Vulnerable | Drupal |
| cpe:2.3:a:drupal:drupal:7.38:*:*:*:*:*:*:* | 7.38 | Vulnerable | Drupal |
| cpe:2.3:a:drupal:drupal:7.40:*:*:*:*:*:*:* | 7.40 | Vulnerable | Drupal |
| cpe:2.3:a:drupal:drupal:7.41:*:*:*:*:*:*:* | 7.41 | Vulnerable | Drupal |
| cpe:2.3:a:drupal:drupal:7.x-dev:*:*:*:*:*:*:* | 7.x-dev | Vulnerable | Drupal |
| cpe:2.3:a:drupal:drupal:8.0.0:*:*:*:*:*:*:* | 8.0.0 | Vulnerable | Drupal |
| cpe:2.3:a:drupal:drupal:8.0.1:*:*:*:*:*:*:* | 8.0.1 | Vulnerable | Drupal |
| cpe:2.3:a:drupal:drupal:8.0.2:*:*:*:*:*:*:* | 8.0.2 | Vulnerable | Drupal |
| cpe:2.3:a:drupal:drupal:8.0.3:*:*:*:*:*:*:* | 8.0.3 | Vulnerable | Drupal |
| cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Debian |
- cpe:2.3:a:drupal:drupal:7.0:beta3:*:*:*:*:*:* Versions 7.0 beta3 Vulnerable ·Drupal
- cpe:2.3:a:drupal:drupal:7.0:dev:*:*:*:*:*:* Versions 7.0 dev Vulnerable ·Drupal
- cpe:2.3:a:drupal:drupal:7.0:rc1:*:*:*:*:*:* Versions 7.0 rc1 Vulnerable ·Drupal
- cpe:2.3:a:drupal:drupal:7.0:rc2:*:*:*:*:*:* Versions 7.0 rc2 Vulnerable ·Drupal
- cpe:2.3:a:drupal:drupal:7.0:rc3:*:*:*:*:*:* Versions 7.0 rc3 Vulnerable ·Drupal
- cpe:2.3:a:drupal:drupal:7.0:rc4:*:*:*:*:*:* Versions 7.0 rc4 Vulnerable ·Drupal
- cpe:2.3:a:drupal:drupal:7.1:*:*:*:*:*:*:* Versions 7.1 Vulnerable ·Drupal
- cpe:2.3:a:drupal:drupal:7.2:*:*:*:*:*:*:* Versions 7.2 Vulnerable ·Drupal
- cpe:2.3:a:drupal:drupal:7.3:*:*:*:*:*:*:* Versions 7.3 Vulnerable ·Drupal
- cpe:2.3:a:drupal:drupal:7.4:*:*:*:*:*:*:* Versions 7.4 Vulnerable ·Drupal
- cpe:2.3:a:drupal:drupal:7.5:*:*:*:*:*:*:* Versions 7.5 Vulnerable ·Drupal
- cpe:2.3:a:drupal:drupal:7.6:*:*:*:*:*:*:* Versions 7.6 Vulnerable ·Drupal
- cpe:2.3:a:drupal:drupal:7.7:*:*:*:*:*:*:* Versions 7.7 Vulnerable ·Drupal
- cpe:2.3:a:drupal:drupal:7.8:*:*:*:*:*:*:* Versions 7.8 Vulnerable ·Drupal
- cpe:2.3:a:drupal:drupal:7.9:*:*:*:*:*:*:* Versions 7.9 Vulnerable ·Drupal
- cpe:2.3:a:drupal:drupal:7.10:*:*:*:*:*:*:* Versions 7.10 Vulnerable ·Drupal
- cpe:2.3:a:drupal:drupal:7.11:*:*:*:*:*:*:* Versions 7.11 Vulnerable ·Drupal
- cpe:2.3:a:drupal:drupal:7.12:*:*:*:*:*:*:* Versions 7.12 Vulnerable ·Drupal
- cpe:2.3:a:drupal:drupal:7.13:*:*:*:*:*:*:* Versions 7.13 Vulnerable ·Drupal
- cpe:2.3:a:drupal:drupal:7.14:*:*:*:*:*:*:* Versions 7.14 Vulnerable ·Drupal
- cpe:2.3:a:drupal:drupal:7.15:*:*:*:*:*:*:* Versions 7.15 Vulnerable ·Drupal
- cpe:2.3:a:drupal:drupal:7.16:*:*:*:*:*:*:* Versions 7.16 Vulnerable ·Drupal
- cpe:2.3:a:drupal:drupal:7.17:*:*:*:*:*:*:* Versions 7.17 Vulnerable ·Drupal
- cpe:2.3:a:drupal:drupal:7.18:*:*:*:*:*:*:* Versions 7.18 Vulnerable ·Drupal
- cpe:2.3:a:drupal:drupal:7.19:*:*:*:*:*:*:* Versions 7.19 Vulnerable ·Drupal
- cpe:2.3:a:drupal:drupal:7.20:*:*:*:*:*:*:* Versions 7.20 Vulnerable ·Drupal
- cpe:2.3:a:drupal:drupal:7.21:*:*:*:*:*:*:* Versions 7.21 Vulnerable ·Drupal
- cpe:2.3:a:drupal:drupal:7.22:*:*:*:*:*:*:* Versions 7.22 Vulnerable ·Drupal
- cpe:2.3:a:drupal:drupal:7.23:*:*:*:*:*:*:* Versions 7.23 Vulnerable ·Drupal
- cpe:2.3:a:drupal:drupal:7.24:*:*:*:*:*:*:* Versions 7.24 Vulnerable ·Drupal
- cpe:2.3:a:drupal:drupal:7.25:*:*:*:*:*:*:* Versions 7.25 Vulnerable ·Drupal
- cpe:2.3:a:drupal:drupal:7.26:*:*:*:*:*:*:* Versions 7.26 Vulnerable ·Drupal
- cpe:2.3:a:drupal:drupal:7.27:*:*:*:*:*:*:* Versions 7.27 Vulnerable ·Drupal
- cpe:2.3:a:drupal:drupal:7.28:*:*:*:*:*:*:* Versions 7.28 Vulnerable ·Drupal
- cpe:2.3:a:drupal:drupal:7.29:*:*:*:*:*:*:* Versions 7.29 Vulnerable ·Drupal
- cpe:2.3:a:drupal:drupal:7.30:*:*:*:*:*:*:* Versions 7.30 Vulnerable ·Drupal
- cpe:2.3:a:drupal:drupal:7.31:*:*:*:*:*:*:* Versions 7.31 Vulnerable ·Drupal
- cpe:2.3:a:drupal:drupal:7.32:*:*:*:*:*:*:* Versions 7.32 Vulnerable ·Drupal
- cpe:2.3:a:drupal:drupal:7.33:*:*:*:*:*:*:* Versions 7.33 Vulnerable ·Drupal
- cpe:2.3:a:drupal:drupal:7.34:*:*:*:*:*:*:* Versions 7.34 Vulnerable ·Drupal
- cpe:2.3:a:drupal:drupal:7.35:*:*:*:*:*:*:* Versions 7.35 Vulnerable ·Drupal
- cpe:2.3:a:drupal:drupal:7.36:*:*:*:*:*:*:* Versions 7.36 Vulnerable ·Drupal
- cpe:2.3:a:drupal:drupal:7.37:*:*:*:*:*:*:* Versions 7.37 Vulnerable ·Drupal
- cpe:2.3:a:drupal:drupal:7.38:*:*:*:*:*:*:* Versions 7.38 Vulnerable ·Drupal
- cpe:2.3:a:drupal:drupal:7.40:*:*:*:*:*:*:* Versions 7.40 Vulnerable ·Drupal
- cpe:2.3:a:drupal:drupal:7.41:*:*:*:*:*:*:* Versions 7.41 Vulnerable ·Drupal
- cpe:2.3:a:drupal:drupal:7.x-dev:*:*:*:*:*:*:* Versions 7.x-dev Vulnerable ·Drupal
- cpe:2.3:a:drupal:drupal:8.0.0:*:*:*:*:*:*:* Versions 8.0.0 Vulnerable ·Drupal
- cpe:2.3:a:drupal:drupal:8.0.1:*:*:*:*:*:*:* Versions 8.0.1 Vulnerable ·Drupal
- cpe:2.3:a:drupal:drupal:8.0.2:*:*:*:*:*:*:* Versions 8.0.2 Vulnerable ·Drupal
- cpe:2.3:a:drupal:drupal:8.0.3:*:*:*:*:*:*:* Versions 8.0.3 Vulnerable ·Drupal
- cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
Remediation
- Fix · GHSA-w2pj-c8x5-jvg2 drupal/core (Packagist) Fixed in 7.43 Advisory →
- Fix · GHSA-w2pj-c8x5-jvg2 drupal/core (Packagist) Fixed in 8.0.4 Advisory →
- Fix · GHSA-w2pj-c8x5-jvg2 drupal/drupal (Packagist) Fixed in 8.0.4 Advisory →
- Fix · GHSA-w2pj-c8x5-jvg2 drupal/drupal (Packagist) Fixed in 7.43 Advisory →
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2016-3162
- 2026-10-03 Alias added: GHSA-w2pj-c8x5-jvg2
References
Other 5
- [oss-security] 20160224 CVE requests for Drupal core (SA-CORE-2016-001)
- [oss-security] 20160315 Re: CVE requests for Drupal core (SA-CORE-2016-001)
- https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2016-3162.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2016-3162.yaml
- https://github.com/drupal/core
Sources
- CVE-2016-3162 · CVE Program
- CVE-2016-3162 · NVD
- FIRST EPSS
- GHSA-w2pj-c8x5-jvg2 · GitHub Advisory Database · CC BY 4.0
- CVE-2016-3162 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences