Packagist/drupal/core CVE-2020-13670: unknown, EPSS 1.11%

A vulnerability exists in the File module which allows an attacker to gain access to the file metadata of a permanent private file that they do not have access to by guessing the ID of the file.

Action: Upgrade drupal/core to 8.8.10 or later.

composer require drupal/core:8.8.10

composer require drupal/core:8.9.6

composer require drupal/core:9.0.6

Affected

introduced	fixed	last affected
8.0.0	8.8.10	-
8.9.0	8.9.6	-
9.0.0	9.0.6	-

Fixed versions

8.8.10

8.9.6

9.0.6

Sources

osv: DRUPAL-CORE-2020-011
https://www.drupal.org/sa-core-2020-011

CVE-2020-13670 · published 2020-09-16T16:45:26Z · modified 2026-09-19T17:37:46Z · JSON