Vulnerability advisory

CVE-2016-3162

Published Apr 12, 2016Updated Oct 24, 2026OSV record ↗

Severity

CVSS 3.xCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/drupal/drupal ↗
497914920385b7016ac9c9367e0198530787adf2 through 3f7404935955cd2a63023e77a07c4231ad5ff62a	No fix listed
Also listed as affected (88) `7.0` `7.0-alpha1` `7.0-alpha2` `7.0-alpha3` `7.0-alpha4` `7.0-alpha5` `7.0-alpha6` `7.0-alpha7` `7.0-beta1` `7.0-beta2` `7.0-beta3` `7.1` `7.10` `7.11` `7.12` `7.13` `7.14` `7.15` `7.16` `7.17` `7.18` `7.19` `7.2` `7.20` `7.21` `7.22` `7.23` `7.24` `7.25` `7.26` `7.27` `7.28` `7.29` `7.3` `7.30` `7.31` `7.32` `7.33` `7.34` `7.35` `7.36` `7.37` `7.38` `7.4` `7.40` `7.41` `7.5` `7.6` `7.7` `7.8` `7.9` `8.0.0` `8.0.1` `8.0.2` `8.0.3` `8.0.0-rc4` `8.0.0-rc3` `8.0.0-rc2` `8.0.0-rc1` `8.0.0-beta16` `8.0.0-beta15` `8.0.0-beta14` `8.0.0-beta13` `8.0.0-beta12` `8.0.0-beta11` `8.0.0-beta10` `8.0.0-beta9` `8.0.0-beta7` `8.0.0-beta6` `8.0.0-beta5` `8.0.0-beta4` `8.0.0-beta3` `8.0.0-beta2` `8.0.0-beta1` `8.0.0-alpha15` `8.0.0-alpha14` `8.0-alpha13` `8.0-alpha12` `8.0-alpha11` `8.0-alpha10` `8.0-alpha9` `8.0-alpha8` `8.0-alpha7` `8.0-alpha6` `8.0-alpha5` `8.0-alpha4` `8.0-alpha3` `8.0-alpha2`

Description

The File module in Drupal 7.x before 7.43 and 8.x before 8.0.4 allows remote authenticated users to bypass access restrictions and read, delete, or substitute a link to a file uploaded to an unprocessed form by leveraging permission to create content or comment and upload files.

CVE-2016-3162

Affected versions

Repository

Description

References