View online: https://www.drupal.org/sa-core-2024-002
Project: Drupal core [1] Date: 2024-October-16 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:None/CI:None/II:All/E:Theoretical/TD:Uncommon [2] Vulnerability: Improper error handling
Affected versions: >=10.0 < 10.2.10 Description: Under certain uncommon site configurations, a bug in the CKEditor 5 module can cause some image uploads to move the entire webroot to a different location on the file system. This could be exploited by a malicious user to take down a site.
The issue is mitigated by the fact that several non-default site configurations must exist simultaneously for this to occur.
Solution: Install the latest version:
* If you are using Drupal 10.2, update to Drupal 10.2.10 [3]. * Drupal 10.3 and above are not affected, nor is Drupal 7.
All versions of Drupal 10 prior to 10.2 are end-of-life and do not receive security coverage. (Drupal 8 [4] and Drupal 9 [5] have both reached end-of-life.)
This advisory is not covered by Drupal Steward [6].
Reported By: * Pierre Rudloff [7]
Fixed By: * catch [8] of the Drupal Security Team * Lee Rowlands [9] of the Drupal Security Team * Benji Fisher [10] of the Drupal Security Team * Kim Pepper [11] * Wim Leers [12] * xjm [13] of the Drupal Security Team
Coordinated By: * xjm [14] of the Drupal Security Team * Dave Long [15] of the Drupal Security Team * Juraj Nemec [16] of the Drupal Security Team
[1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/drupal/releases/10.2.10 [4] https://www.drupal.org/psa-2021-06-29 [5] https://www.drupal.org/psa-2023-11-01 [6] https://www.drupal.org/steward [7] https://www.drupal.org/user/3611858 [8] https://www.drupal.org/user/35733 [9] https://www.drupal.org/user/395439 [10] https://www.drupal.org/user/683300 [11] https://www.drupal.org/user/370574 [12] https://www.drupal.org/user/99777 [13] https://www.drupal.org/user/65776 [14] https://www.drupal.org/user/65776 [15] https://www.drupal.org/u/longwave [16] https://www.drupal.org/u/poker10