Vulnerability advisory

GHSA-52jr-x6h6-xj6g

Drupal core vulnerable to improper error handling

Published Dec 5, 2024Updated Dec 10, 2025OSV record ↗

Also known as BIT-drupal-2024-11942CVE-2024-11942DRUPAL-CORE-2024-002

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected versions

drupal/core Packagist

All drupal/core advisories →

Affected	Fixed in
`10.0.0` to before 10.2.10	`10.2.10`Advisories →
Also listed as affected (37) `10.0.0` `10.0.1` `10.0.10` `10.0.11` `10.0.2` `10.0.3` `10.0.4` `10.0.5` `10.0.6` `10.0.7` `10.0.8` `10.0.9` `10.1.0` `10.1.0-alpha1` `10.1.0-beta1` `10.1.0-rc1` `10.1.1` `10.1.2` `10.1.3` `10.1.4` `10.1.5` `10.1.6` `10.1.7` `10.1.8` `10.2.0` `10.2.0-alpha1` `10.2.0-beta1` `10.2.0-rc1` `10.2.1` `10.2.2` `10.2.3` `10.2.4` `10.2.5` `10.2.6` `10.2.7` `10.2.8` `10.2.9`

Description

Under certain uncommon site configurations, a bug in the CKEditor 5 module can cause some image uploads to move the entire webroot to a different location on the file system. This could be exploited by a malicious user to take down a site.

The issue is mitigated by the fact that several non-default site configurations must exist simultaneously for this to occur.

References

Advisorynvd.nist.gov/vuln/detail/CVE-2024-11942 ↗
Packagegithub.com/drupal/core ↗
Webwww.drupal.org/sa-core-2024-002 ↗