| Package | Affected versions | Patched versions |
|---|---|---|
| drupal/core | ≥ 11.0.0, < 11.1.0≥ 11.1.0, < 11.2.0≥ 11.2.0, < 11.3.0≥ 11.3.0, < 11.3.14≥ 11.4.0, < 11.4.4< 10.6.13 | 11.1.011.2.011.3.011.3.1411.4.410.6.13 |
The Image module allows you to define and configure image fields.
The module doesn't sufficiently check access to image style derivatives when those files are served via a file stream other than private://.
This vulnerability is mitigated by the fact that Drupal must be configured to use a contributed (non-core) file scheme to serve private derived images.
Information disclosure issues like this one are not generally given security advisories (as described in PSA-2023-07-12)). This fix is provided as a hardening. Contributed modules implementing custom stream wrappers may need to add similar hardenings.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free