{"self":"https:\/\/www.drupal.org\/api-d7\/node?field_sa_cve=CVE-2025-13083","first":"https:\/\/www.drupal.org\/api-d7\/node?field_sa_cve=CVE-2025-13083\u0026page=0","last":"https:\/\/www.drupal.org\/api-d7\/node?field_sa_cve=CVE-2025-13083\u0026page=0","list":[{"field_issue_status":"7","field_project":{"uri":"https:\/\/www.drupal.org\/api-d7\/node\/3060","id":"3060","resource":"node"},"field_sa_advisory_id":"008","field_sa_coordinated_by":{"value":"\u003Cul\u003E\n\u003Cli\u003E\u003Ca href=\u0022\/u\/catch\u0022 rel=\u0022nofollow\u0022\u003E catch (catch)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/larowlan\u0022 rel=\u0022nofollow\u0022\u003ELee Rowlands (larowlan)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/longwave\u0022 rel=\u0022nofollow\u0022\u003EDave Long (longwave)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/mcdruid\u0022 rel=\u0022nofollow\u0022\u003EDrew Webber (mcdruid)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/poker10\u0022 rel=\u0022nofollow\u0022\u003EJuraj Nemec (poker10)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003C\/ul\u003E","format":"1"},"field_sa_criticality":"AC:Complex\/A:None\/CI:Some\/II:None\/E:Theoretical\/TD:Uncommon","field_sa_description":{"value":"\u003Cp\u003EThe core \u003Ccode class=\u0022language-php\u0022\u003Esystem\u003C\/code\u003E module handles downloads of private and temporary files. Contrib modules can define additional kinds of files (schemes) that may also be handled by the \u003Ccode class=\u0022language-php\u0022\u003Esystem\u003C\/code\u003E module.\u003C\/p\u003E\n\u003Cp\u003EIn some cases, files may be served with the HTTP header \u003Ccode class=\u0022language-php\u0022\u003ECache-Control: public\u003C\/code\u003E when they should be uncacheable. This can lead to some users getting cached versions of files with information they should not be able to access. For example, files may be cached by Varnish or a CDN.\u003C\/p\u003E\n\u003Cp\u003EThis vulnerability is mitigated by the following:\u003C\/p\u003E\n\u003Col type=\u00221\u0022\u003E\n\u003Cli\u003EDrupal must be configured to handle non-public files using a custom or contributed module providing an additional file scheme.\u003C\/li\u003E\n\u003Cli\u003EAn attacker must know to request a file that has previously been\u003Cbr \/\u003E\nrequested by a more-privileged user, and that file must still be cached.\u003C\/li\u003E\n\u003C\/ol\u003E","format":"1"},"field_sa_fixed_by":{"value":"\u003Cul\u003E\n\u003Cli\u003E\u003Ca href=\u0022\/u\/benjifisher\u0022 rel=\u0022nofollow\u0022\u003EBenji Fisher (benjifisher)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/catch\u0022 rel=\u0022nofollow\u0022\u003E catch (catch)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/drumm\u0022 rel=\u0022nofollow\u0022\u003ENeil Drumm (drumm)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/larowlan\u0022 rel=\u0022nofollow\u0022\u003ELee Rowlands (larowlan)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/mingsong\u0022 rel=\u0022nofollow\u0022\u003EMingsong  (mingsong)\u003C\/a\u003E, provisional member of the Drupal Security Team\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/mohit_aghera\u0022 rel=\u0022nofollow\u0022\u003EMohit Aghera (mohit_aghera)\u003C\/a\u003E\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/neclimdul\u0022 rel=\u0022nofollow\u0022\u003EJames Gilliland (neclimdul)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/poker10\u0022 rel=\u0022nofollow\u0022\u003EJuraj Nemec (poker10)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/xjm\u0022 rel=\u0022nofollow\u0022\u003EJess  (xjm)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003C\/ul\u003E","format":"1"},"field_sa_reported_by":{"value":"\u003Cul\u003E\n\u003Cli\u003E\u003Ca href=\u0022\/u\/damienmckenna\u0022 rel=\u0022nofollow\u0022\u003EDamien McKenna (damienmckenna)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/tame4tex\u0022 rel=\u0022nofollow\u0022\u003Etame4tex\u003C\/a\u003E\n\u003C\/li\u003E\u003C\/ul\u003E","format":"1"},"field_sa_solution":{"value":"\u003Cp\u003EInstall the latest version:\u003C\/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EIf you are using Drupal 10.4, update to \u003Ca href=\u0022https:\/\/www.drupal.org\/project\/drupal\/releases\/10.4.9\u0022 rel=\u0022nofollow\u0022\u003EDrupal 10.4.9\u003C\/a\u003E.\u003C\/li\u003E\n\u003Cli\u003EIf you are using Drupal 10.5, update to \u003Ca href=\u0022https:\/\/www.drupal.org\/project\/drupal\/releases\/10.5.6\u0022 rel=\u0022nofollow\u0022\u003EDrupal 10.5.6\u003C\/a\u003E.\u003C\/li\u003E\n\u003Cli\u003EIf you are using Drupal 11.1, update to \u003Ca href=\u0022https:\/\/www.drupal.org\/project\/drupal\/releases\/11.1.9\u0022 rel=\u0022nofollow\u0022\u003EDrupal 11.1.9\u003C\/a\u003E.\u003C\/li\u003E\n\u003Cli\u003EIf you are using Drupal 11.2, update to \u003Ca href=\u0022https:\/\/www.drupal.org\/project\/drupal\/releases\/11.2.8\u0022 rel=\u0022nofollow\u0022\u003EDrupal 11.2.8\u003C\/a\u003E.\u003C\/li\u003E\n\u003C\/ul\u003E\n\u003Cp\u003EDrupal 11.0.x, Drupal 10.3.x, and below are end-of-life and do not receive security coverage. (\u003Ca href=\u0022https:\/\/www.drupal.org\/psa-2021-06-29\u0022 rel=\u0022nofollow\u0022\u003EDrupal 8\u003C\/a\u003E and \u003Ca href=\u0022https:\/\/www.drupal.org\/psa-2023-11-01\u0022 rel=\u0022nofollow\u0022\u003EDrupal 9\u003C\/a\u003E have both reached end-of-life.)\u003C\/p\u003E","format":"1"},"field_sa_type":"Information disclosure","field_issue_last_status_change":"1763051823","field_sa_cve":["CVE-2025-13083"],"field_is_psa":"0","field_affected_versions":"\u003E= 8.0.0 \u003C 10.4.9 || \u003E= 10.5.0 \u003C 10.5.6 || \u003E= 11.0.0 \u003C 11.1.9 || \u003E= 11.2.0 \u003C 11.2.8","field_fixed_in":[{"uri":"https:\/\/www.drupal.org\/api-d7\/node\/3557509","id":"3557509","resource":"node"},{"uri":"https:\/\/www.drupal.org\/api-d7\/node\/3557510","id":"3557510","resource":"node"},{"uri":"https:\/\/www.drupal.org\/api-d7\/node\/3557512","id":"3557512","resource":"node"},{"uri":"https:\/\/www.drupal.org\/api-d7\/node\/3557515","id":"3557515","resource":"node"}],"nid":"3557473","vid":"14179687","is_new":false,"type":"sa","title":"Drupal core - Moderately critical - Information disclosure - SA-CORE-2025-008","language":"en","url":"https:\/\/www.drupal.org\/sa-core-2025-008","edit_url":"https:\/\/www.drupal.org\/node\/3557473\/edit","status":"1","promote":"0","sticky":"0","created":"1762978582","changed":"1763051823","author":{"uri":"https:\/\/www.drupal.org\/api-d7\/user\/406161","id":"406161","resource":"user","name":"Drupal Security Team"},"comment":"0","comments":[{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16343387","id":16343387,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16343388","id":16343388,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16343389","id":16343389,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16343390","id":16343390,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16343391","id":16343391,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16343392","id":16343392,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16343393","id":16343393,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16343394","id":16343394,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16343395","id":16343395,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16343396","id":16343396,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16343397","id":16343397,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16343667","id":16343667,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16343668","id":16343668,"resource":"comment"}],"comment_count":0,"comment_count_new":false,"body":[],"feeds_item_guid":null,"feeds_item_url":null,"feed_nid":null,"flag_flag_tracker_follow_user":[],"flag_tracker_follower_count":null,"has_new_content":null,"last_comment_timestamp":"1762978582"}]}