Kim Pepper

**Name of the Vulnerable Software and Affected Versions** Drupal core versions 0.0.0 through 10.6.13 Drupal core versions 11.3.0 through 11.3.14 Drupal core versions 11.4.0 through 11.4.4 Drupal core versions 0.0.0 through 11.0.x Drupal core versions 0.0.0 through 11.1.x Drupal core versions 0.0.0 through 11.2.x **Description** A missing authorization issue in the Image module allows forceful browsing, leading to information disclosure. The module fails to sufficiently check access to image style derivatives when files are served via a file stream other than `private://`. This issue occurs when Drupal is configured to use a contributed file scheme to serve private derived images. **Recommendations** Update versions 0.0.0 through 10.6.13 to a newer version. Update versions 11.3.0 through 11.3.14 to a newer version. Update versions 11.4.0 through 11.4.4 to a newer version. Update versions 0.0.0 through 11.0.x to a newer version. Update versions 0.0.0 through 11.1.x to a newer version. Update versions 0.0.0 through 11.2.x to a newer version.

**Name of the Vulnerable Software and Affected Versions** Drupal core (affected versions not specified) **Description** The JSON:API and REST modules allow image file uploads to image fields. The validation rules verify the file extension but fail to check the file MIME type (Multipurpose Internet Mail Extensions), which is a standard used to identify the nature and format of a document. This flaw allows a malicious user to upload non-image files. Depending on the web-server configuration, these files may be served using their actual MIME type, potentially leading to cross-site scripting (XSS), where malicious scripts are injected into trusted websites, or other unexpected behavior. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Drupal One Time Password versions 0.0.0 through 1.3.0 **Description** The issue is related to an Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal One Time Password, allowing functionality bypass. **Recommendations** For versions 0.0.0 through 1.3.0, update to version 1.3.0 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Drupal One Time Password versions 0.0.0 through 1.3.0 **Description** The issue is related to an Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal One Time Password, allowing functionality bypass. **Recommendations** For versions 0.0.0 through 1.3.0, update to version 1.3.0 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Drupal Core versions 10.0.0 through 10.2.9 Description: A vulnerability in Drupal Core allows file manipulation. This issue is related to weaknesses in handling error situations, which could allow a remote attacker to impact the integrity of protected information. Under certain uncommon site configurations, a bug in the CKEditor 5 module can cause some image uploads to move the entire webroot to a different location on the file system, potentially allowing a malicious user to take down a site. The issue is mitigated by the fact that several non-default site configurations must exist simultaneously for this to occur. Recommendations: For Drupal Core versions 10.0.0 through 10.2.9, update to version 10.2.10 or later to resolve the issue. As a temporary workaround, consider restricting access to the CKEditor 5 module to minimize the risk of exploitation. Avoid using the module for image uploads until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Archive Tar versions 1.4.11 and earlier **Description** The vulnerability in the Archive Tar library's Tar.php file is related to improper link resolution, allowing an attacker to impact data integrity through directory traversal due to inadequate checking of symbolic links. **Recommendations** For Archive Tar versions 1.4.11 and earlier, update to version 1.4.13 to resolve the issue. As a temporary workaround, consider restricting write operations to prevent directory traversal until the update is applied.