{"action":"Upgrade drupal/core to 8.6.16 or later.","affected":[{"fixed":"8.6.16","introduced":"8.0.0"},{"fixed":"8.7.1","introduced":"8.7.0"}],"component":"drupal/core","cve_ids":["CVE-2019-11831"],"ecosystem":"Packagist","epss":0.05436,"exploited":false,"fixed_versions":["8.6.16","8.7.1"],"ghsa_id":"GHSA-xv7v-rf6g-xwrc","id":"tcs_01M5KER7PVFJ0BXVRKGE2V2AA8","modified_at":"2026-09-19T19:25:50Z","published_at":"2019-05-08T16:56:58Z","references":["https://osv.dev/vulnerability/DRUPAL-CORE-2019-007","https://www.drupal.org/sa-core-2019-007"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"DRUPAL-CORE-2019-007","url":"https://osv.dev/vulnerability/DRUPAL-CORE-2019-007"}],"summary":"This security release fixes third-party dependencies included in or required by Drupal core. As described in [TYPO3-PSA-2019-007: By-passing protection of Phar Stream Wrapper Interceptor](https://typo"}