Vulnerability advisory

CVE-2023-31250

Drupal core - Moderately critical - Access bypass - SA-CORE-2023-005

Published Apr 26, 2023Updated Oct 28, 2026OSV record ↗

Also known as BIT-drupal-2023-31250DRUPAL-CORE-2023-005GHSA-8849-cv9f-vccm

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/drupal/drupal ↗
497914920385b7016ac9c9367e0198530787adf2 to before d5d2a01bb6de80b202e141278312ab2d376f3c63	`d5d2a01bb6de80b202e141278312ab2d376f3c63`
970c1b5cfa946f683de326a3f252b5371a42186a to before 260b4d16f44ab87794972b3ad3ced896afe640e8	`260b4d16f44ab87794972b3ad3ced896afe640e8`
0db8126913ff8f271ef13c24684c0f3402a967f4 to before 47c5f228e18b3a26476800c0baa141b56cc9d71d	`47c5f228e18b3a26476800c0baa141b56cc9d71d`
2700c5afb6c3936041db413872eea82dc0bd4fe4 to before 13b06fc9c636c051eb1c3349ceb9429a78add4c4	`13b06fc9c636c051eb1c3349ceb9429a78add4c4`
Also listed as affected (65) `7.95` `9.4.13` `9.5.7` `10.0.7` `9.5.6` `10.0.6` `7.94` `9.4.11` `9.5.4` `10.0.4` `9.5.3` `9.4.9` `9.5.1` `10.0.0` `9.5.0` `7.93` `9.4.8` `9.4.6` `7.92` `9.4.5` `9.4.4` `7.90` `9.4.2` `9.4.1` `9.4.0` `7.89` `7.87` `7.85` `7.84` `7.83` `7.81` `7.79` `7.77` `7.76` `7.71` `7.68` `7.64` `7.61` `7.56` `7.55` `7.54` `7.51` `7.50` `7.43` `7.42` `7.40` `7.37` `7.36` `7.33` `7.30` `7.28` `7.25` `7.23` `7.22` `7.17` `7.15` `7.14` `7.12` `7.10` `7.9` `7.8` `7.7` `7.6` `7.4` `7.0`

Description

The file download facility doesn't sufficiently sanitize file paths in certain situations. This may result in users gaining access to private files that they should not have access to. Some sites may require configuration changes following this security release. Review the release notes for your Drupal version if you have issues accessing private files after updating.

CVE-2023-31250

Affected versions

Repository

Description

References