Packagist/drupal/core CVE-2023-5256: unknown, EPSS 0.85%

In certain scenarios, Drupal's JSON:API module will output error backtraces. With some configurations, this may cause sensitive information to be cached and made available to anonymous users, leading

Action: Upgrade drupal/core to 9.5.11 or later.

composer require drupal/core:9.5.11

composer require drupal/core:10.0.11

composer require drupal/core:10.1.4

Affected

introduced	fixed	last affected
8.7.0	9.5.11	-
10.0.0	10.0.11	-
10.1.0	10.1.4	-

Fixed versions

9.5.11

10.0.11

10.1.4

Sources

osv: DRUPAL-CORE-2023-006
https://www.drupal.org/sa-core-2023-006

CVE-2023-5256 · published 2023-09-20T16:23:05Z · modified 2026-09-19T18:25:15Z · JSON