UnratedFix available

Drupal core - Moderately critical - Information disclosure - SA-CORE-2025-008

Drupal core may serve some private or temporary files with a public cache header, potentially exposing cached file contents to users without access. The issue requires a custom or contributed module that provides an additional file scheme for non-public files; an attacker must also know to request a file previously requested by a more-privileged user while it remains cached.

Products: Drupal core
Affected versions: >= 8.0.0 < 10.4.9 || >= 10.5.0 < 10.5.6 || >= 11.0.0 < 11.1.9 || >= 11.2.0 < 11.2.8
Fixed versions: 10.4.9, 10.5.6, 11.1.9, 11.2.8
CVEs: CVE-2025-13083
Confirmed fixed CVEs: Not specified
Updated in this feed: 31 Oct 2026, 13:24 UTC · Revision 1

Source evidence

Drupal core - Moderately critical - Information disclosure - SA-CORE-2025-008

official-drupal-security · Original source

Published 12 Nov 2025, 20:16 UTC

In some cases, files may be served with the HTTP header Cache-Control: public when they should be uncacheable. This can lead to some users getting cached versions of files with information they should not be able to access.

Drupal core

Fixed versions: 10.4.9, 10.5.6, 11.1.9, 11.2.8

Prerequisites: Drupal must be configured to handle non-public files using a custom or contributed module providing an additional file scheme.; An attacker must know to request a file that has previously been requested by a more-privileged user, and that file must still be cached.

Complete source record

{
  "id": "852df73d593314e7f940369989c26c37d6708879d0268995c3996a37ca97008b",
  "url": "https://www.drupal.org/sa-core-2025-008",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "Drupal core - Moderately critical - Information disclosure - SA-CORE-2025-008",
    "summary": "Drupal core may serve some private or temporary files with a public cache header, potentially exposing cached file contents to users without access. The issue requires a custom or contributed module that provides an additional file scheme for non-public files; an attacker must also know to request a file previously requested by a more-privileged user while it remains cached.",
    "evidence": "In some cases, files may be served with the HTTP header Cache-Control: public when they should be uncacheable. This can lead to some users getting cached versions of files with information they should not be able to access.",
    "products": [
      {
        "name": {
          "value": "Drupal core",
          "evidence": "Project: Drupal core"
        },
        "prerequisites": [
          {
            "value": "Drupal must be configured to handle non-public files using a custom or contributed module providing an additional file scheme.",
            "evidence": "Drupal must be configured to handle non-public files using a custom or contributed module providing an additional file scheme."
          },
          {
            "value": "An attacker must know to request a file that has previously been requested by a more-privileged user, and that file must still be cached.",
            "evidence": "An attacker must know to request a file that has previously been requested by a more-privileged user, and that file must still be cached."
          }
        ],
        "fixed_versions": [
          {
            "value": "10.4.9",
            "evidence": "If you are using Drupal 10.4, update to Drupal 10.4.9."
          },
          {
            "value": "10.5.6",
            "evidence": "If you are using Drupal 10.5, update to Drupal 10.5.6."
          },
          {
            "value": "11.1.9",
            "evidence": "If you are using Drupal 11.1, update to Drupal 11.1.9."
          },
          {
            "value": "11.2.8",
            "evidence": "If you are using Drupal 11.2, update to Drupal 11.2.8."
          }
        ],
        "affected_versions": [
          {
            "value": ">= 8.0.0 < 10.4.9 || >= 10.5.0 < 10.5.6 || >= 11.0.0 < 11.1.9 || >= 11.2.0 < 11.2.8",
            "evidence": "Affected versions: >= 8.0.0 < 10.4.9 || >= 10.5.0 < 10.5.6 || >= 11.0.0 < 11.1.9 || >= 11.2.0 < 11.2.8"
          }
        ]
      }
    ],
    "severity": "unknown",
    "fixed_cves": [],
    "related_cves": [
      {
        "value": "CVE-2025-13083",
        "evidence": "CVE IDs: CVE-2025-13083"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "official-drupal-security",
  "document_id": 23469,
  "published_at": "2025-11-12T20:16:22+00:00"
}