Read the docs
TI-2022-08980 Aliases CVE-2022-25275GHSA-xh3v-6f9j-wxw3

In some situations, the Image module does not correctly check access to image files not…

Priority MEDIUM 40Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub.

Summary

In some situations, the Image module does not correctly check access to image files not stored in the standard public files directory when generating derivative images using the image styles system. Access to a non-public file is checked only if it is stored in the "private" file system. However, some contributed modules provide additional file systems, or schemes, which may lead to this vulnerability. This vulnerability is mitigated by the fact that it only applies when the site sets (Drupal 9) $config['image.settings']['allow_insecure_derivatives'] or (Drupal 7) $conf['image_allow_insecure_derivatives'] to TRUE. The recommended and default setting is FALSE, and Drupal core does not provide a way to change that in the admin UI. Some sites may require configuration changes following this security release. Review the release notes for your Drupal version if you have issues accessing files or image styles after updating.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00667 52nd percentileScored 2026-11-07
Fix Fixed Core (Drupal): 9.4.3, 9.3.19, 7.91drupal/core (Packagist): 7.91, 9.3.19, 9.4.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
DrupalCore9.4 to before 9.4.3; 9.3 to before 9.3.19; 7 to before 7.919.4.3, 9.3.19, 7.91Patch availableCNA
—drupal/core (Packagist)7.0.0 to before 7.917.91Patch availableGHSA-xh3v-6f9j-wxw3
—drupal/core (Packagist)8.0.0 to before 9.3.199.3.19Patch availableGHSA-xh3v-6f9j-wxw3
—drupal/core (Packagist)9.4.0 to before 9.4.39.4.3Patch availableGHSA-xh3v-6f9j-wxw3
  • Core VendorDrupal Affected 9.4 to before 9.4.3; 9.3 to before 9.3.19; 7 to before 7.91 Fixed in 9.4.3, 9.3.19, 7.91 Patch available CNA
  • drupal/core (Packagist) Vendor— Affected 7.0.0 to before 7.91 Fixed in 7.91 Patch available GHSA-xh3v-6f9j-wxw3
  • drupal/core (Packagist) Vendor— Affected 8.0.0 to before 9.3.19 Fixed in 9.3.19 Patch available GHSA-xh3v-6f9j-wxw3
  • drupal/core (Packagist) Vendor— Affected 9.4.0 to before 9.4.3 Fixed in 9.4.3 Patch available GHSA-xh3v-6f9j-wxw3

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*7.0 to before 7.91; 8.0.0 to before 9.3.19; 9.4.0 to before 9.4.3VulnerableDrupal
  • cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* Versions 7.0 to before 7.91; 8.0.0 to before 9.3.19; 9.4.0 to before 9.4.3 Vulnerable ·Drupal

Remediation

  • Fix · CNA Core (Drupal) Fixed in 9.4.3, 9.3.19, 7.91
  • Fix · GHSA-xh3v-6f9j-wxw3 drupal/core (Packagist) Fixed in 7.91 Advisory →
  • Fix · GHSA-xh3v-6f9j-wxw3 drupal/core (Packagist) Fixed in 9.3.19 Advisory →
  • Fix · GHSA-xh3v-6f9j-wxw3 drupal/core (Packagist) Fixed in 9.4.3 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-25275
  2. 2026-10-03 Alias added: GHSA-xh3v-6f9j-wxw3

References

Advisory 2

Other 4

  • TI-2026-07979 Drupal core - Highly critical - SQL injection - SA-CORE-2026-004 KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-05494 Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-004 KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-05493 Improper input validation in Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6… KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-10731 Unrestricted file upload in Drupal Core KEVCVSS 3.1HIGH 8.8
  • TI-2019-04505 Drupal core - Highly critical - Remote Code Execution KEVCVSS 3.1HIGH 8.1
  • TI-2020-17477 Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks… KEVCVSS 3.1HIGH 7.8
See all 278 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences