-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| drupal/core | composer | >= 7.0.0, < 7.91 | 7.91 |
| drupal/core | composer | >= 8.0.0, < 9.3.19 | 9.3.19 |
| drupal/core | composer | >= 9.4.0, < 9.4.3 | 9.4.3 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper access checks for non-public file schemes. The deliver() method's original logic in ImageStyleDownloadController.php only triggered access checks for the 'private' scheme. The commit diff shows significant changes to this method, introducing checks for additional public schemes via Settings::get('file_additional_public_schemes') and refactoring the access control logic. This confirms the function's role in the vulnerability. The system_file_download() hook in system.module was part of the fix, not the vulnerability itself.
Ongoing coverage of React2Shell