PT-2024-9995 · Unknown+1 · Ckeditor 5+1

Benji Fisher

+7

·

Published

2024-10-16

·

Updated

2025-06-03

·

CVE-2024-11942

CVSS v3.1

5.9

Medium

VectorAV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Name of the Vulnerable Software and Affected Versions: Drupal Core versions 10.0.0 through 10.2.9
Description: A vulnerability in Drupal Core allows file manipulation. This issue is related to weaknesses in handling error situations, which could allow a remote attacker to impact the integrity of protected information. Under certain uncommon site configurations, a bug in the CKEditor 5 module can cause some image uploads to move the entire webroot to a different location on the file system, potentially allowing a malicious user to take down a site. The issue is mitigated by the fact that several non-default site configurations must exist simultaneously for this to occur.
Recommendations: For Drupal Core versions 10.0.0 through 10.2.9, update to version 10.2.10 or later to resolve the issue. As a temporary workaround, consider restricting access to the CKEditor 5 module to minimize the risk of exploitation. Avoid using the module for image uploads until the issue is resolved.

Fix

Weakness Enumeration

Related Identifiers

BDU:2025-00121
BIT-DRUPAL-2024-11942
CVE-2024-11942
DRUPAL-CORE-2024-002
GHSA-52JR-X6H6-XJ6G

Affected Products

Ckeditor 5
Drupal Core