ByteOS Network

CVE Vulnerability Details :

CVE-2025-7717

PUBLISHED

More Info Official Page

Assigner-drupal

Assigner Org ID-2c85b837-eb8b-40ed-9d74-228c62987387

Published At-21 Jul, 2025 | 16:37

Updated At-22 Jul, 2025 | 14:00

▼CVE Numbering Authority (CNA)

File Download - Moderately critical - Access bypass - SA-CONTRIB-2025-089

Missing Authorization vulnerability in Drupal File Download allows Forceful Browsing.This issue affects File Download: from 0.0.0 before 1.9.0, from 2.0.0 before 2.0.1.

Affected Products

Vendor

The Drupal Association

Product

File Download

Collection URL

https://www.drupal.org/project/file_download

Repo

https://git.drupalcode.org/project/file_download

Default Status

unaffected

Versions

Affected

From 0.0.0 before 1.9.0 (semver)
From 2.0.0 before 2.0.1 (semver)

Problem Types

Type	CWE ID	Description
CWE	CWE-862	CWE-862 Missing Authorization

Impacts

CAPEC ID	Description
CAPEC-87	CAPEC-87 Forceful Browsing

Credits

finder

Willem Drupal enthousiast (willempje2)

remediation developer

Shelane French (shelane)

remediation developer

Willem Drupal enthousiast (willempje2)

coordinator

Greg Knaddison (greggles)

coordinator

Juraj Nemec (poker10)

coordinator

Jess (xjm)

References

Hyperlink	Resource
https://www.drupal.org/sa-contrib-2025-089	N/A

▼Authorized Data Publishers (ADP)

CISA ADP Vulnrichment

Metrics

Version	Base score	Base severity	Vector
3.1	7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References