Drupal core - Moderately critical - Access bypass - SA-CORE-2023-005

Vulnerability

The file download facility in Drupal core fails to sufficiently sanitize file paths in certain situations, allowing users to access private files they should not have access to [2]. This is an access bypass vulnerability classified as moderately critical [3].

Exploitation

Exploitation conditions vary by Drupal version and platform. For Drupal 7, all sites on Windows web servers are vulnerable, while sites on Linux are vulnerable only with certain file directory structures or if a vulnerable contributed or custom file access module is installed. For Drupal 9 and 10, sites are only vulnerable if certain contributed or custom file access modules are installed [3]. The vulnerability requires an authenticated user, but does not require any special privileges beyond the ability to download files.

Impact

Successful exploitation allows an attacker to read private files that should be restricted. The impact is limited to file disclosure; the vulnerability is considered not mass exploitable according to the Drupal Security Team [3].

Mitigation

Patches are available for affected versions: Drupal 7.96, 9.4.14, 9.5.8, 10.0.8, and later releases [3]. Some sites may require configuration changes after updating; administrators should review release notes for their Drupal version if issues with private file access arise [2].