Access bypass – SA-CORE-2023-005

The file download facility doesn’t sufficiently sanitize file paths in certain situations. This may result in users gaining access to private files that they should not have access to.

This vulnerability affects the following application versions:

• Drupal 7.0
• Drupal 7.1
• Drupal 7.2
• Drupal 7.3
• Drupal 7.4
• Drupal 7.5
• Drupal 7.6
• Drupal 7.7
• Drupal 7.8
• Drupal 7.9
• Drupal 7.10
• Drupal 7.11
• Drupal 7.12
• Drupal 7.13
• Drupal 7.14
• Drupal 7.15
• Drupal 7.16
• Drupal 7.17
• Drupal 7.18
• Drupal 7.19
• Drupal 7.20
• Drupal 7.21
• Drupal 7.22
• Drupal 7.23
• Drupal 7.24
• Drupal 7.25
• Drupal 7.26
• Drupal 7.27
• Drupal 7.28
• Drupal 7.29
• Drupal 7.30
• Drupal 7.31
• Drupal 7.32
• Drupal 7.33
• Drupal 7.34
• Drupal 7.35
• Drupal 7.36
• Drupal 7.37
• Drupal 7.38
• Drupal 7.39
• Drupal 7.40
• Drupal 7.41
• Drupal 7.42
• Drupal 7.43
• Drupal 7.44
• Drupal 7.50
• Drupal 7.51
• Drupal 7.52
• Drupal 7.53
• Drupal 7.54
• Drupal 7.55
• Drupal 7.56
• Drupal 7.57
• Drupal 7.58
• Drupal 7.59
• Drupal 7.60
• Drupal 7.61
• Drupal 7.62
• Drupal 7.63
• Drupal 7.64
• Drupal 7.65
• Drupal 7.66
• Drupal 7.67
• Drupal 7.68
• Drupal 7.69
• Drupal 7.70
• Drupal 7.71
• Drupal 7.72
• Drupal 7.73
• Drupal 7.74
• Drupal 7.75
• Drupal 7.76
• Drupal 7.77
• Drupal 7.78
• Drupal 7.79
• Drupal 7.80
• Drupal 7.81
• Drupal 7.82
• Drupal 7.83
• Drupal 7.84
• Drupal 7.85
• Drupal 7.86
• Drupal 7.87
• Drupal 7.88
• Drupal 7.89
• Drupal 7.90
• Drupal 7.91
• Drupal 7.92
• Drupal 7.93
• Drupal 7.94
• Drupal 7.95
• Drupal 8.8.0
• Drupal 8.8.1
• Drupal 8.8.2
• Drupal 8.8.3
• Drupal 8.8.4
• Drupal 8.8.5
• Drupal 8.8.6
• Drupal 8.8.7
• Drupal 8.8.8
• Drupal 8.8.9
• Drupal 8.8.10
• Drupal 8.8.11
• Drupal 8.8.12
• Drupal 8.9.0
• Drupal 8.9.1
• Drupal 8.9.2
• Drupal 8.9.3
• Drupal 8.9.4
• Drupal 8.9.5
• Drupal 8.9.6
• Drupal 8.9.7
• Drupal 8.9.8
• Drupal 8.9.9
• Drupal 8.9.10
• Drupal 8.9.11
• Drupal 8.9.12
• Drupal 8.9.13
• Drupal 8.9.14
• Drupal 8.9.15
• Drupal 8.9.16
• Drupal 8.9.17
• Drupal 8.9.18
• Drupal 8.9.19
• Drupal 8.9.20
• Drupal 9.0.0
• Drupal 9.0.1
• Drupal 9.0.2
• Drupal 9.0.3
• Drupal 9.0.4
• Drupal 9.0.5
• Drupal 9.0.6
• Drupal 9.0.7
• Drupal 9.0.8
• Drupal 9.0.9
• Drupal 9.0.10
• Drupal 9.0.11
• Drupal 9.0.12
• Drupal 9.0.13
• Drupal 9.0.14
• Drupal 9.1.0
• Drupal 9.1.1
• Drupal 9.1.2
• Drupal 9.1.3
• Drupal 9.1.4
• Drupal 9.1.5
• Drupal 9.1.6
• Drupal 9.1.7
• Drupal 9.1.8
• Drupal 9.1.9
• Drupal 9.1.10
• Drupal 9.1.11
• Drupal 9.1.12
• Drupal 9.1.13
• Drupal 9.1.14
• Drupal 9.1.15
• Drupal 9.2.0
• Drupal 9.2.1
• Drupal 9.2.2
• Drupal 9.2.3
• Drupal 9.2.4
• Drupal 9.2.5
• Drupal 9.2.6
• Drupal 9.2.7
• Drupal 9.2.8
• Drupal 9.2.9
• Drupal 9.2.10
• Drupal 9.2.11
• Drupal 9.2.12
• Drupal 9.2.13
• Drupal 9.2.14
• Drupal 9.2.15
• Drupal 9.2.16
• Drupal 9.2.17
• Drupal 9.2.18
• Drupal 9.2.19
• Drupal 9.2.20
• Drupal 9.2.21
• Drupal 9.3.0
• Drupal 9.3.1
• Drupal 9.3.2
• Drupal 9.3.3
• Drupal 9.3.4
• Drupal 9.3.5
• Drupal 9.3.6
• Drupal 9.3.7
• Drupal 9.3.8
• Drupal 9.3.9
• Drupal 9.3.10
• Drupal 9.3.11
• Drupal 9.3.12
• Drupal 9.3.13
• Drupal 9.3.14
• Drupal 9.3.15
• Drupal 9.3.16
• Drupal 9.3.17
• Drupal 9.3.18
• Drupal 9.3.19
• Drupal 9.3.20
• Drupal 9.3.21
• Drupal 9.3.22
• Drupal 9.4.0
• Drupal 9.4.1
• Drupal 9.4.2
• Drupal 9.4.3
• Drupal 9.4.4
• Drupal 9.4.5
• Drupal 9.4.6
• Drupal 9.4.7
• Drupal 9.4.8
• Drupal 9.4.9
• Drupal 9.4.10
• Drupal 9.4.11
• Drupal 9.4.12
• Drupal 9.4.13
• Drupal 9.5.0
• Drupal 9.5.1
• Drupal 9.5.2
• Drupal 9.5.3
• Drupal 9.5.4
• Drupal 9.5.5
• Drupal 9.5.6
• Drupal 9.5.7
• Drupal 10.0.0
• Drupal 10.0.1
• Drupal 10.0.2
• Drupal 10.0.3
• Drupal 10.0.4
• Drupal 10.0.5
• Drupal 10.0.6
• Drupal 10.0.7