Search for packages
| purl | pkg:composer/drupal/core@8.7.0-alpha2 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-12yf-8sub-uyhb
Aliases: GHSA-v273-j5hq-26xp |
Drupal core uses a vulnerable Third-party library CKEditor |
Affected by 33 other vulnerabilities. Affected by 44 other vulnerabilities. |
|
VCID-1d2m-3ycf-3ycf
Aliases: CVE-2025-13080 GHSA-83v7-c2cf-p9c2 |
Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-26ck-rher-hfg4
Aliases: CVE-2024-55634 GHSA-7cwc-fjqm-8vh8 |
A vulnerability in Drupal Core allows Privilege Escalation.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8. |
Affected by 8 other vulnerabilities. Affected by 8 other vulnerabilities. Affected by 8 other vulnerabilities. |
|
VCID-2wdn-8583-v3dg
Aliases: CVE-2020-13670 GHSA-mmjr-5q74-p3m4 |
Exposure of Resource to Wrong Sphere in Drupal Core |
Affected by 33 other vulnerabilities. Affected by 34 other vulnerabilities. Affected by 30 other vulnerabilities. |
|
VCID-3y39-quaw-ufe8
Aliases: GHSA-mh4h-27gq-cxwj |
Drupal core Access bypass |
Affected by 35 other vulnerabilities. Affected by 46 other vulnerabilities. |
|
VCID-4sqe-bvj6-pkdq
Aliases: CVE-2025-31673 GHSA-wpp8-fjgf-pwc7 |
Incorrect Authorization vulnerability in Drupal Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3. |
Affected by 5 other vulnerabilities. Affected by 5 other vulnerabilities. Affected by 5 other vulnerabilities. Affected by 5 other vulnerabilities. |
|
VCID-57k5-xdsf-h3ch
Aliases: CVE-2020-13674 GHSA-j586-cj67-vg4p |
multiple issues |
Affected by 23 other vulnerabilities. Affected by 24 other vulnerabilities. Affected by 27 other vulnerabilities. |
|
VCID-57nk-7ugd-vucf
Aliases: CVE-2020-13671 GHSA-68jc-v27h-vhmw |
Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP for certain hosting configurations. This issue affects: Drupal Drupal Core 9.0 versions prior to 9.0.8, 8.9 versions prior to 8.9.9, 8.8 versions prior to 8.8.11, and 7 versions prior to 7.74. |
Affected by 32 other vulnerabilities. Affected by 33 other vulnerabilities. Affected by 29 other vulnerabilities. |
|
VCID-7sar-42a4-kqdy
Aliases: CVE-2024-45440 GHSA-mg8j-w93w-xjgc |
core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the value of hash_salt is file_get_contents of a file that does not exist. |
Affected by 14 other vulnerabilities. Affected by 8 other vulnerabilities. Affected by 13 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 12 other vulnerabilities. |
|
VCID-94he-hr4a-yygs
Aliases: CVE-2025-13083 GHSA-mhpg-hpj5-73r2 |
Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8, from 7.0 before 7.103. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-a4ps-1cdu-4ucv
Aliases: GHSA-gxxj-g9v8-w28p |
Drupal core Arbitrary PHP code execution |
Affected by 29 other vulnerabilities. Affected by 30 other vulnerabilities. Affected by 26 other vulnerabilities. |
|
VCID-aqce-af3u-myd2
Aliases: CVE-2025-31674 GHSA-2qph-q8xw-gv7q |
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3. |
Affected by 5 other vulnerabilities. Affected by 5 other vulnerabilities. Affected by 5 other vulnerabilities. Affected by 5 other vulnerabilities. |
|
VCID-e4nv-qway-2ygf
Aliases: GHSA-98h9-727m-44qv |
Drupal core Multiple vulnerabilities due to the use of the third-party library Archive_Tar |
Affected by 35 other vulnerabilities. Affected by 46 other vulnerabilities. |
|
VCID-e5uh-sqmj-qyg7
Aliases: CVE-2025-13082 GHSA-h89p-5896-f4q8 |
User Interface (UI) Misrepresentation of Critical Information vulnerability in Drupal Drupal core allows Content Spoofing.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-ed3c-h2ww-j3gm
Aliases: CVE-2022-24775 GHSA-q7rv-6hp3-vh96 |
guzzlehttp/psr7 is a PSR-7 HTTP message library. Versions prior to 1.8.4 and 2.1.1 are vulnerable to improper header parsing. An attacker could sneak in a new line character and pass untrusted values. The issue is patched in 1.8.4 and 2.1.1. There are currently no known workarounds. |
Affected by 24 other vulnerabilities. Affected by 22 other vulnerabilities. Affected by 25 other vulnerabilities. Affected by 15 other vulnerabilities. |
|
VCID-eje5-fhmg-hbbt
Aliases: CVE-2022-39261 GHSA-52m2-vc4m-jj33 |
Twig is a template language for PHP. Versions 1.x prior to 1.44.7, 2.x prior to 2.15.3, and 3.x prior to 3.4.3 encounter an issue when the filesystem loader loads templates for which the name is a user input. It is possible to use the `source` or `include` statement to read arbitrary files from outside the templates' directory when using a namespace like `@somewhere/../some.file`. In such a case, validation is bypassed. Versions 1.44.7, 2.15.3, and 3.4.3 contain a fix for validation of such template names. There are no known workarounds aside from upgrading. |
Affected by 17 other vulnerabilities. Affected by 16 other vulnerabilities. |
|
VCID-fqah-snwt-qfhj
Aliases: GHSA-pr99-c33p-fwf6 |
Drupal core Denial of Service |
Affected by 35 other vulnerabilities. Affected by 46 other vulnerabilities. |
|
VCID-hdq9-fe9e-93hb
Aliases: CVE-2022-25275 GHSA-xh3v-6f9j-wxw3 GMS-2022-3362 |
In some situations, the Image module does not correctly check access to image files not stored in the standard public files directory when generating derivative images using the image styles system. Access to a non-public file is checked only if it is stored in the "private" file system. However, some contributed modules provide additional file systems, or schemes, which may lead to this vulnerability. This vulnerability is mitigated by the fact that it only applies when the site sets (Drupal 9) $config['image.settings']['allow_insecure_derivatives'] or (Drupal 7) $conf['image_allow_insecure_derivatives'] to TRUE. The recommended and default setting is FALSE, and Drupal core does not provide a way to change that in the admin UI. Some sites may require configuration changes following this security release. Review the release notes for your Drupal version if you have issues accessing files or image styles after updating. |
Affected by 18 other vulnerabilities. Affected by 18 other vulnerabilities. |
|
VCID-k48k-jdda-zqbh
Aliases: CVE-2020-13677 GHSA-3xr3-phjp-g6p2 |
multiple issues |
Affected by 23 other vulnerabilities. Affected by 24 other vulnerabilities. Affected by 27 other vulnerabilities. |
|
VCID-krdz-kyhc-efg5
Aliases: GHSA-7gwj-7fhm-vw4w |
Drupal core unrestricted file upload |
Affected by 35 other vulnerabilities. Affected by 46 other vulnerabilities. |
|
VCID-kryq-8j5g-d7a6
Aliases: CVE-2020-13668 GHSA-m6q5-wv4x-fv6h |
Cross-site Scripting in Drupal Core |
Affected by 33 other vulnerabilities. Affected by 34 other vulnerabilities. Affected by 30 other vulnerabilities. |
|
VCID-muhk-wbuy-97bu
Aliases: CVE-2020-28948 GHSA-jh5x-hfhg-78jq |
Multiple vulnerabilities have been found in PEAR Archive_Tar, the worst of which could result in the arbitrary execution of code. |
Affected by 30 other vulnerabilities. Affected by 23 other vulnerabilities. Affected by 26 other vulnerabilities. Affected by 24 other vulnerabilities. |
|
VCID-nhub-1map-n3by
Aliases: CVE-2022-25277 GHSA-6955-67hm-vjjq GMS-2022-3361 |
Drupal core sanitizes filenames with dangerous extensions upon upload (reference: SA-CORE-2020-012) and strips leading and trailing dots from filenames to prevent uploading server configuration files (reference: SA-CORE-2019-010). However, the protections for these two vulnerabilities previously did not work correctly together. As a result, if the site were configured to allow the upload of files with an htaccess extension, these files' filenames would not be properly sanitized. This could allow bypassing the protections provided by Drupal core's default .htaccess files and possible remote code execution on Apache web servers. This issue is mitigated by the fact that it requires a field administrator to explicitly configure a file field to allow htaccess as an extension (a restricted permission), or a contributed module or custom code that overrides allowed file uploads. |
Affected by 18 other vulnerabilities. Affected by 18 other vulnerabilities. |
|
VCID-nx17-duan-vyak
Aliases: CVE-2025-13081 GHSA-m6vv-vcj8-w8m7 |
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-qvsn-ab7h-cqc5
Aliases: CVE-2020-13672 GHSA-3m36-mjwj-352c |
multiple issues |
Affected by 28 other vulnerabilities. Affected by 24 other vulnerabilities. Affected by 29 other vulnerabilities. |
|
VCID-rf34-12k7-xbh4
Aliases: CVE-2025-3057 GHSA-39g6-x4x8-5jcm |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3. |
Affected by 5 other vulnerabilities. Affected by 5 other vulnerabilities. Affected by 5 other vulnerabilities. Affected by 5 other vulnerabilities. |
|
VCID-tdsq-5bqr-aufq
Aliases: CVE-2025-31675 GHSA-m4wj-hhwj-47qp |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).This issue affects Drupal core: from 8.0.0 before 10.3.14, from 10.4.0 before 10.4.5, from 11.0.0 before 11.0.13, from 11.1.0 before 11.1.5. It also affects the Drupal 7 module from versions 7.x-1.0 through 7.x-1.12. |
Affected by 4 other vulnerabilities. Affected by 4 other vulnerabilities. Affected by 4 other vulnerabilities. Affected by 4 other vulnerabilities. |
|
VCID-v7ya-c9mf-e7dp
Aliases: GHSA-vfgc-c76h-mwh4 |
Drupal core Cross-Site Scripting (XSS) vulnerabilities |
Affected by 27 other vulnerabilities. Affected by 28 other vulnerabilities. Affected by 31 other vulnerabilities. |
|
VCID-vpn8-qteh-9yhz
Aliases: GHSA-6ccv-8fgf-cjpw GMS-2024-214 |
Drupal core Denial of Service vulnerability |
Affected by 15 other vulnerabilities. Affected by 15 other vulnerabilities. |
|
VCID-w5a9-jg34-3ubx
Aliases: CVE-2020-13676 GHSA-qfhg-m6r8-xxpj |
multiple issues |
Affected by 23 other vulnerabilities. Affected by 24 other vulnerabilities. Affected by 27 other vulnerabilities. |
|
VCID-wn4r-rc6m-xbhy
Aliases: CVE-2022-25278 GHSA-cfh2-7f6h-3m85 |
Under certain circumstances, the Drupal core form API evaluates form element access incorrectly. This may lead to a user being able to alter data they should not have access to. No forms provided by Drupal core are known to be vulnerable. However, forms added through contributed or custom modules or themes may be affected. |
Affected by 18 other vulnerabilities. Affected by 18 other vulnerabilities. |
|
VCID-xsma-2ryf-zqd4
Aliases: CVE-2020-13675 GHSA-v8wr-r69p-mmwx |
multiple issues |
Affected by 23 other vulnerabilities. Affected by 24 other vulnerabilities. Affected by 27 other vulnerabilities. |
|
VCID-yku8-k9fs-d7c8
Aliases: CVE-2020-13669 GHSA-c533-c843-67h8 |
Drupal core Cross-site Scripting (XSS) vulnerability in ckeditor |
Affected by 33 other vulnerabilities. Affected by 34 other vulnerabilities. Affected by 30 other vulnerabilities. |
|
VCID-zxut-nxke-7fce
Aliases: CVE-2022-25273 GHSA-g36h-4jr6-qmm9 |
Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow an attacker to inject disallowed values or overwrite data. Affected forms are uncommon, but in certain cases an attacker could alter critical or sensitive data. |
Affected by 23 other vulnerabilities. Affected by 23 other vulnerabilities. |
|
VCID-zymc-a812-1ua5
Aliases: CVE-2022-25276 GHSA-4wfq-jc9h-vpcx |
Affected by 18 other vulnerabilities. Affected by 18 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||