DRUPAL-CORE-2025-008 BIT-drupal-2025-13083 CVE-2025-13083 GHSA-mhpg-hpj5-73r2
Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels
- Severity
- 0.0 / 10
- Low · CVSS 4.0
- Exploit chance (EPSS)
- 0.28%
- Chance of exploitation in the next 30 days. Higher than 20.32% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-525 Use of Web Browser Cache Containing Sensitive Information
- Fix
11.2.8- Upgrade drupal/core to this version or later
Description
The core system module handles downloads of private and temporary files. Contrib modules can define additional kinds of files (schemes) that may also be handled by the system module.
In some cases, files may be served with the HTTP header Cache-Control: public when they should be uncacheable. This can lead to some users getting cached versions of files with information they should not be able to access. For example, files may be cached by Varnish or a CDN.
This vulnerability is mitigated by the following:
- Drupal must be configured to handle non-public files using a custom or contributed module providing an additional file scheme.
- An attacker must know to request a file that has previously been
requested by a more-privileged user, and that file must still be cached.
Affected versions
Packagist
| Package | Vulnerable | Fixed in |
|---|---|---|
| drupal/core | >= 8.0.0, < 10.4.9>= 10.5.0, < 10.5.6>= 11.0.0, < 11.1.9>= 11.2.0, < 11.2.8 |
10.4.910.5.611.1.911.2.8 |
| drupal/core | >= 8.0.0, < 10.4.9 |
10.4.9 |
| drupal/core | >= 10.5.0, < 10.5.6 |
10.5.6 |
| drupal/core | >= 11.0.0, < 11.1.9 |
11.1.9 |
| drupal/core | >= 11.2.0, < 11.2.8 |
11.2.8 |
| drupal/core | >= 7.0, < 7.103 |
7.103 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
drupal/core Packagist → 11.2.8
- composer
composer require drupal/core:^11.2.8
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- Present
- Privileges required
- None
- User interaction
- None
- Confidentiality (vulnerable system)
- Low
- Integrity (vulnerable system)
- None
- Availability (vulnerable system)
- None
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
- Exploit maturity
- Unreported
CVSS 3.1 3.7
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
- Attack vector
- Network
- Attack complexity
- High
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Weakness
CWE-525: Use of Web Browser Cache Containing Sensitive Information
The web application does not use an appropriate caching policy that specifies the extent to which each web page and associated form fields should be cached.
How to prevent it
- Architecture and Design: Protect information stored in cache.
- Implementation: Use a restrictive caching policy for forms and web pages that potentially contain sensitive information, such as "no-cache" in the Cache-Control header.
- Architecture and Design: Do not store unnecessarily sensitive information in the cache.
- Architecture and Design: Consider using encryption in the cache.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| DRUPAL-CORE-2026-004 Drupal Core has a SQL Injection issue | Critical Known exploited | Also affects drupal/core |
| CVE-2020-28949 Multiple vulnerabilities through filename manipulation in Archive_Tar | High Known exploited | Also affects drupal/core |
| CVE-2020-13671 Drupal core Unrestricted Upload of File with Dangerous Type | High Known exploited | Also affects drupal/core |
| CVE-2019-6340 Drupal Core Remote Code Execution Vulnerability | High Known exploited | Also affects drupal/core |
| CVE-2018-7602 Drupal Core Remote Code Execution Vulnerability | Critical Known exploited | Also affects drupal/core |
| CVE-2018-7600 Drupal Core Remote Code Execution Vulnerability | Critical Known exploited | Also affects drupal/core |
| DRUPAL-CORE-2026-016 The Navigation module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting (XSS) vulnerability. | Not rated yet | Also affects drupal/core |
| DRUPAL-CORE-2026-015 The Drupal core Link module provides a field type that can be used for internal and external URLs. | Not rated yet | Also affects drupal/core |
Credits: Damien McKenna (damienmckenna), tame4tex
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor