Packagist/drupal/core CVE-2024-11942: unknown, EPSS 0.39%

Under certain uncommon site configurations, a bug in the CKEditor 5 module can cause some image uploads to move the entire webroot to a different location on the file system. This could be exploited b

Action: Upgrade drupal/core to 10.2.10 or later.

composer require drupal/core:10.2.10

Affected

introduced	fixed	last affected
10.0.0	10.2.10	-

Fixed versions

10.2.10

Sources

osv: DRUPAL-CORE-2024-002
https://www.drupal.org/sa-core-2024-002

CVE-2024-11942 · published 2024-10-16T16:27:27Z · modified 2025-12-10T23:40:59.635498Z · JSON