Drupal core - Moderately critical - Information disclosure - SA-CORE-2025-008

Vulnerability

Overview

CVE-2025-13083 is an information disclosure vulnerability in Drupal core's system module, which handles downloads of private and temporary files. The root cause is a use of web browser cache containing sensitive information vulnerability, where files served by Drupal may be incorrectly assigned the HTTP header Cache-Control: public when they should be uncacheable. This misconfiguration allows sensitive data to be stored in shared across users via shared caching layers such as Varnish or a CDN [3].

Exploitation

Conditions

Exploitation requires several conditions to be met. First, Drupal must be configured to handle non-public files using a custom or contributed module that provides an additional file scheme. Second, an attacker must know to request a specific file that has previously been requested by a more-privileged user, and that file must still be present in the cache [3]. The attack does not require authentication, but relies on the attacker being able to guess or discover the file path.

Impact

If successfully exploited, an attacker can retrieve cached versions of files that contain information they should not be able to access. This could include private documents, user data, or other sensitive content that was intended to be restricted to authorized users only [3].

Mitigation

The vulnerability affects Drupal core versions from 8.0.0 before 10.4.9, 10.5.0 before 10.5.6, 11.0.0 before 11.1.9, 11.2.0 before 11.2.8, and 7.0 before 7.103 [2]. The Drupal Security Team has released patches in the latest versions of each supported branch: 10. Users are strongly advised to update to Drupal 10.4.9, 10.5.6, 11.1.9, or 11.2.8 as appropriate. Older branches such as Drupal 11.0.x, 10.3.x, and below are end-of-life and do not receive security coverage [3].