Vulnerability advisory

DRUPAL-CORE-2024-002

Published Oct 16, 2024Updated Dec 10, 2025OSV record ↗

Also known as BIT-drupal-2024-11942CVE-2024-11942GHSA-52jr-x6h6-xj6g

Severity

Severity not reported.

Affected versions

drupal/core Packagist

Affected	Fixed in
`10.0.0` to before 10.2.10	`10.2.10`Advisories →
Also listed as affected (37) `10.0.0` `10.0.1` `10.0.10` `10.0.11` `10.0.2` `10.0.3` `10.0.4` `10.0.5` `10.0.6` `10.0.7` `10.0.8` `10.0.9` `10.1.0` `10.1.0-alpha1` `10.1.0-beta1` `10.1.0-rc1` `10.1.1` `10.1.2` `10.1.3` `10.1.4` `10.1.5` `10.1.6` `10.1.7` `10.1.8` `10.2.0` `10.2.0-alpha1` `10.2.0-beta1` `10.2.0-rc1` `10.2.1` `10.2.2` `10.2.3` `10.2.4` `10.2.5` `10.2.6` `10.2.7` `10.2.8` `10.2.9`

Description

Under certain uncommon site configurations, a bug in the CKEditor 5 module can cause some image uploads to move the entire webroot to a different location on the file system. This could be exploited by a malicious user to take down a site.

The issue is mitigated by the fact that several non-default site configurations must exist simultaneously for this to occur.

References

Webwww.drupal.org/sa-core-2024-002 ↗