Information disclosure – SA-CORE-2022-012

In some situations, the Image module does not correctly check access to image files not stored in the standard public files directory when generating derivative images using the image styles system.

This vulnerability affects the following application versions:

• Drupal 7.0
• Drupal 7.1
• Drupal 7.2
• Drupal 7.3
• Drupal 7.4
• Drupal 7.5
• Drupal 7.6
• Drupal 7.7
• Drupal 7.8
• Drupal 7.9
• Drupal 7.10
• Drupal 7.11
• Drupal 7.12
• Drupal 7.13
• Drupal 7.14
• Drupal 7.15
• Drupal 7.16
• Drupal 7.17
• Drupal 7.18
• Drupal 7.19
• Drupal 7.20
• Drupal 7.21
• Drupal 7.22
• Drupal 7.23
• Drupal 7.24
• Drupal 7.25
• Drupal 7.26
• Drupal 7.27
• Drupal 7.28
• Drupal 7.29
• Drupal 7.30
• Drupal 7.31
• Drupal 7.32
• Drupal 7.33
• Drupal 7.34
• Drupal 7.35
• Drupal 7.36
• Drupal 7.37
• Drupal 7.38
• Drupal 7.39
• Drupal 7.40
• Drupal 7.41
• Drupal 7.42
• Drupal 7.43
• Drupal 7.44
• Drupal 7.50
• Drupal 7.51
• Drupal 7.52
• Drupal 7.53
• Drupal 7.54
• Drupal 7.55
• Drupal 7.56
• Drupal 7.57
• Drupal 7.58
• Drupal 7.59
• Drupal 7.60
• Drupal 7.61
• Drupal 7.62
• Drupal 7.63
• Drupal 7.64
• Drupal 7.65
• Drupal 7.66
• Drupal 7.67
• Drupal 7.68
• Drupal 7.69
• Drupal 7.70
• Drupal 7.71
• Drupal 7.72
• Drupal 7.73
• Drupal 7.74
• Drupal 7.75
• Drupal 7.76
• Drupal 7.77
• Drupal 7.78
• Drupal 7.79
• Drupal 7.80
• Drupal 7.81
• Drupal 7.82
• Drupal 7.83
• Drupal 7.84
• Drupal 7.85
• Drupal 7.86
• Drupal 7.87
• Drupal 7.88
• Drupal 7.89
• Drupal 7.90
• Drupal 8.8.0
• Drupal 8.8.1
• Drupal 8.8.2
• Drupal 8.8.3
• Drupal 8.8.4
• Drupal 8.8.5
• Drupal 8.8.6
• Drupal 8.8.7
• Drupal 8.8.8
• Drupal 8.8.9
• Drupal 8.8.10
• Drupal 8.8.11
• Drupal 8.8.12
• Drupal 8.9.0
• Drupal 8.9.1
• Drupal 8.9.2
• Drupal 8.9.3
• Drupal 8.9.4
• Drupal 8.9.5
• Drupal 8.9.6
• Drupal 8.9.7
• Drupal 8.9.8
• Drupal 8.9.9
• Drupal 8.9.10
• Drupal 8.9.11
• Drupal 8.9.12
• Drupal 8.9.13
• Drupal 8.9.14
• Drupal 8.9.15
• Drupal 8.9.16
• Drupal 8.9.17
• Drupal 8.9.18
• Drupal 8.9.19
• Drupal 8.9.20
• Drupal 9.0.0
• Drupal 9.0.1
• Drupal 9.0.2
• Drupal 9.0.3
• Drupal 9.0.4
• Drupal 9.0.5
• Drupal 9.0.6
• Drupal 9.0.7
• Drupal 9.0.8
• Drupal 9.0.9
• Drupal 9.0.10
• Drupal 9.0.11
• Drupal 9.0.12
• Drupal 9.0.13
• Drupal 9.0.14
• Drupal 9.1.0
• Drupal 9.1.1
• Drupal 9.1.2
• Drupal 9.1.3
• Drupal 9.1.4
• Drupal 9.1.5
• Drupal 9.1.6
• Drupal 9.1.7
• Drupal 9.1.8
• Drupal 9.1.9
• Drupal 9.1.10
• Drupal 9.1.11
• Drupal 9.1.12
• Drupal 9.1.13
• Drupal 9.1.14
• Drupal 9.1.15
• Drupal 9.2.0
• Drupal 9.2.1
• Drupal 9.2.2
• Drupal 9.2.3
• Drupal 9.2.4
• Drupal 9.2.5
• Drupal 9.2.6
• Drupal 9.2.7
• Drupal 9.2.8
• Drupal 9.2.9
• Drupal 9.2.10
• Drupal 9.2.11
• Drupal 9.2.12
• Drupal 9.2.13
• Drupal 9.2.14
• Drupal 9.2.15
• Drupal 9.2.16
• Drupal 9.2.17
• Drupal 9.2.18
• Drupal 9.2.19
• Drupal 9.2.20
• Drupal 9.2.21
• Drupal 9.3.0
• Drupal 9.3.1
• Drupal 9.3.2
• Drupal 9.3.3
• Drupal 9.3.4
• Drupal 9.3.5
• Drupal 9.3.6
• Drupal 9.3.7
• Drupal 9.3.8
• Drupal 9.3.9
• Drupal 9.3.10
• Drupal 9.3.11
• Drupal 9.3.12
• Drupal 9.3.13
• Drupal 9.3.14
• Drupal 9.3.15
• Drupal 9.3.16
• Drupal 9.3.17
• Drupal 9.3.18
• Drupal 9.4.0
• Drupal 9.4.1
• Drupal 9.4.2