Severity
- CVSS 3.x
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected versions
Repository
| Affected commits | Fixed by commit |
|---|---|
| GIT github.com/drupal/drupal ↗ | |
| 497914920385b7016ac9c9367e0198530787adf2 to before 492fd4da5c9e8c0695f779f1967e7f90960d343b | 492fd4da5c9e8c0695f779f1967e7f90960d343b |
| b73ab73d39dca97a12513e8a9e4f4da4b0676f5f to before 3c5a5276ab17f2e117ecaae6ecda16f918e5fb7d | 3c5a5276ab17f2e117ecaae6ecda16f918e5fb7d |
| 9b04d294324d9c76be4b596de4316cb8804e8223 to before c9f66f9f581cd0734fe74c1cbb1addce3260cf5d | c9f66f9f581cd0734fe74c1cbb1addce3260cf5d |
Also listed as affected (38)
| |
Description
In Drupal Core versions 7.x prior to 7.62, 8.6.x prior to 8.6.6 and 8.5.x prior to 8.5.9; A remote code execution vulnerability exists in PHP's built-in phar stream wrapper when performing file operations on an untrusted phar:// URI. Some Drupal code (core, contrib, and custom) may be performing file operations on insufficiently validated user input, thereby being exposed to this vulnerability. This vulnerability is mitigated by the fact that such code paths typically require access to an administrative permission or an atypical configuration.