Packagist/drupal/core CVE-2023-31250: unknown, EPSS 0.54%

The file download facility doesn't sufficiently sanitize file paths in certain situations. This may result in users gaining access to private files that they should not have access to.

Action: Upgrade drupal/core to 9.4.14 or later.

composer require drupal/core:9.4.14

composer require drupal/core:9.5.8

composer require drupal/core:10.0.8

Affected

introduced	fixed	last affected
8.0.0	9.4.14	-
9.5.0	9.5.8	-
10.0.0	10.0.8	-

Fixed versions

9.4.14

9.5.8

10.0.8

Sources

osv: DRUPAL-CORE-2023-005
https://www.drupal.org/sa-core-2023-005

CVE-2023-31250 · published 2023-04-19T17:06:18Z · modified 2026-09-19T15:02:34Z · JSON