{"id":"drupal-security-6124fbccfc6a","seq":2035,"kind":"advisory","title":"Drupal core - Moderately critical - Access bypass - SA-CORE-2023-005","url":"https://www.drupal.org/sa-core-2023-005","permalink":"https://vulnpulse.app/items/drupal-security-6124fbccfc6a","summary":"Project: Drupal core Project machine name: drupal Date: 2023-April-19 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:All Vulnerability: Access bypass Affected versions: <7.96.0 || >=9.4.0 <9.4.14 || >=9.5.0 <9.5.8 || >=10.0.0 <10.0.8 || 8.0.* || 8.1.* || 8.2.* || 8.3.* || 8.4.* || 8.5.* || 8.6.* || 8.7.* || 8.8.* || 8.9.* || 9.0.* || 9.1.* || 9.2.* || 9.3.* CVE IDs: CVE-2023-31250 Description: The file download facility doesn't sufficiently sanitize file paths in certain situations. This may result in users gaining access to private files that they…","severity":"critical","techs":["drupal","php"],"cves":["CVE-2023-31250"],"tags":["security"],"source":{"id":"drupal-security","name":"Drupal Security Advisories"},"published_at":"2023-04-19T17:06:18.000Z","fetched_at":"2026-10-21T16:17:45.699Z"}