CVE-2025-13083

Drupal core - Moderately critical - Information disclosure - SA-CORE-2025-008

Description

Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8, from 7.0 before 7.103.

Scores

Weaknesses (CWE)

• CWE-525

Advisories

• DRUPAL-CORE-2025-008 — The core `system` module handles downloads of private and temporary files. Contrib modules can define additional kinds of files (schemes) that may also be handl
• GHSA-mhpg-hpj5-73r2 — Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels

European references

• ENISA EUVD · EUVD-2025-198027
• GCVE · GCVE-0-2025-13083

CERT-FR advisories

• CERTFR-2025-AVI-1003 — Multiples vulnérabilités dans Drupal · cert.ssi.gouv.fr

Affected configurations (NVD CPE)

• cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* ≥ 8.0.0 < 10.4.9
• cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* ≥ 10.5.0 < 10.5.6
• cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* ≥ 11.0.0 < 11.1.9
• cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* ≥ 11.2.0 < 11.2.8

Affected products

References

• https://www.drupal.org/sa-core-2025-008

Sources