Patchwire CVEs, their patch status, and feeds to follow them

CVE-2017-6377

Fixed upstream EPSS 2%

When adding a private file via the editor in Drupal 8.2.x before 8.2.7, the editor will not correctly check access for the file being attached, resulting in an access bypass.

Published 2017-03-16 · CVE record · OSV

Products: Drupal Core

Fixed upstream

Ecosystem	Package	Fixed in
Packagist	drupal/core	8.2.7
Packagist	drupal/drupal	8.2.7