CVE-2022-25275

Description

In some situations, the Image module does not correctly check access to image files not stored in the standard public files directory when generating derivative images using the image styles system. Access to a non-public file is checked only if it is stored in the "private" file system. However, some contributed modules provide additional file systems, or schemes, which may lead to this vulnerability. This vulnerability is mitigated by the fact that it only applies when the site sets (Drupal 9) $config['image.settings']['allow_insecure_derivatives'] or (Drupal 7) $conf['image_allow_insecure_derivatives'] to TRUE. The recommended and default setting is FALSE, and Drupal core does not provide a way to change that in the admin UI. Some sites may require configuration changes following this security release. Review the release notes for your Drupal version if you have issues accessing files or image styles after updating.

7.5

CVSS

Severity: High

CVSS 3.1 •

EPSS 0.31%

Vendor Advisory drupal.org

Affected: Drupal Core

References

Link	Tags
https://www.drupal.org/sa-core-2022-012	vendor advisory

Frequently Asked Questions

What is the severity of CVE-2022-25275?: CVE-2022-25275 has been scored as a high severity vulnerability.
How to fix CVE-2022-25275?: To fix CVE-2022-25275, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2022-25275 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2022-25275 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2022-25275?: CVE-2022-25275 affects Drupal Core.

This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.