{"action":"Upgrade drupal/core to 9.4.14 or later.","affected":[{"fixed":"9.4.14","introduced":"8.0.0"},{"fixed":"9.5.8","introduced":"9.5.0"},{"fixed":"10.0.8","introduced":"10.0.0"}],"component":"drupal/core","cve_ids":["CVE-2023-31250"],"ecosystem":"Packagist","epss":0.0054,"exploited":false,"fixed_versions":["9.4.14","9.5.8","10.0.8"],"ghsa_id":"GHSA-8849-cv9f-vccm","id":"tcs_01M5KERB15GBK5FP2ZVC4WY0F8","modified_at":"2026-09-19T15:02:34Z","published_at":"2023-04-19T17:06:18Z","references":["https://osv.dev/vulnerability/DRUPAL-CORE-2023-005","https://www.drupal.org/sa-core-2023-005"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"DRUPAL-CORE-2023-005","url":"https://osv.dev/vulnerability/DRUPAL-CORE-2023-005"}],"summary":"The file download facility doesn't sufficiently sanitize file paths in certain situations. This may result in users gaining access to private files that they should not have access to."}