Read the docs
TI-2023-14954 Aliases CVE-2023-31250GHSA-8849-cv9f-vccm

Drupal core - Moderately critical - Access bypass - SA-CORE-2023-005

Priority LOW 30CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-863.

Summary

The file download facility doesn't sufficiently sanitize file paths in certain situations. This may result in users gaining access to private files that they should not have access to. Some sites may require configuration changes following this security release. Review the release notes for your Drupal version if you have issues accessing private files after updating.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0054 45th percentileScored 2026-11-07
Fix Fixed Core (Drupal): 7.96, 10.0.8, 9.5.8 +1drupal/core (Packagist): 10.0.8, 9.5.8, 9.4.14 +1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
DrupalCore7.0 to before 7.96; 10.0 to before 10.0.8; 9.5 to before 9.5.8; 9.4 to before 9.4.147.96, 10.0.8, 9.5.8, 9.4.14Patch availableCNA
—drupal/core (Packagist)10.0.0 to before 10.0.810.0.8Patch availableGHSA-8849-cv9f-vccm
—drupal/core (Packagist)9.5.0 to before 9.5.89.5.8Patch availableGHSA-8849-cv9f-vccm
—drupal/core (Packagist)9.0.0 to before 9.4.149.4.14Patch availableGHSA-8849-cv9f-vccm
—drupal/core (Packagist)7.0.0 to before 7.967.96Patch availableGHSA-8849-cv9f-vccm
  • Core VendorDrupal Affected 7.0 to before 7.96; 10.0 to before 10.0.8; 9.5 to before 9.5.8; 9.4 to before 9.4.14 Fixed in 7.96, 10.0.8, 9.5.8, 9.4.14 Patch available CNA
  • drupal/core (Packagist) Vendor— Affected 10.0.0 to before 10.0.8 Fixed in 10.0.8 Patch available GHSA-8849-cv9f-vccm
  • drupal/core (Packagist) Vendor— Affected 9.5.0 to before 9.5.8 Fixed in 9.5.8 Patch available GHSA-8849-cv9f-vccm
  • drupal/core (Packagist) Vendor— Affected 9.0.0 to before 9.4.14 Fixed in 9.4.14 Patch available GHSA-8849-cv9f-vccm
  • drupal/core (Packagist) Vendor— Affected 7.0.0 to before 7.96 Fixed in 7.96 Patch available GHSA-8849-cv9f-vccm

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*7.0 to before 7.96; 9.4 to before 9.4.14; 9.5 to before 9.5.8; 10.0 to before 10.0.8VulnerableDrupal
  • cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* Versions 7.0 to before 7.96; 9.4 to before 9.4.14; 9.5 to before 9.5.8; 10.0 to before 10.0.8 Vulnerable ·Drupal

Remediation

  • Fix · CNA Core (Drupal) Fixed in 7.96, 10.0.8, 9.5.8, 9.4.14
  • Fix · GHSA-8849-cv9f-vccm drupal/core (Packagist) Fixed in 10.0.8 Advisory →
  • Fix · GHSA-8849-cv9f-vccm drupal/core (Packagist) Fixed in 9.5.8 Advisory →
  • Fix · GHSA-8849-cv9f-vccm drupal/core (Packagist) Fixed in 9.4.14 Advisory →
  • Fix · GHSA-8849-cv9f-vccm drupal/core (Packagist) Fixed in 7.96 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-31250
  2. 2026-10-03 Alias added: GHSA-8849-cv9f-vccm

References

Advisory 2

Other 1

  • TI-2026-07979 Drupal core - Highly critical - SQL injection - SA-CORE-2026-004 KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-05494 Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-004 KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-05493 Improper input validation in Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6… KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-10731 Unrestricted file upload in Drupal Core KEVCVSS 3.1HIGH 8.8
  • TI-2019-04505 Drupal core - Highly critical - Remote Code Execution KEVCVSS 3.1HIGH 8.1
  • TI-2020-17477 Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks… KEVCVSS 3.1HIGH 7.8
See all 278 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences