DRUPAL-CONTRIB-2025-118

See a problem?
Import Source
https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/ckeditor5_premium_features/DRUPAL-CONTRIB-2025-118.json
JSON Data
https://api.osv.dev/v1/vulns/DRUPAL-CONTRIB-2025-118
Aliases
  • CVE-2025-13980
Published
2025-12-03T18:48:10Z
Modified
2025-12-10T23:41:26.779859Z
Summary
[none]
Details

The module provides instant integration of the official CKEditor 5 Premium plugins into the Drupal editor configuration.

This module has a path traversal vulnerability, which allows an access bypass to restricted image files in the system.

This access bypass is possible for any account with a View published content permission, but the risk is mitigated by the fact that only images can be opened.

References
Credits

Affected packages

Packagist:https://packages.drupal.org/8 / drupal/ckeditor5_premium_features

Package

Name
drupal/ckeditor5_premium_features
Purl
pkg:composer/drupal/ckeditor5_premium_features

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.2.10
Database specific 
{
    "constraint": "<1.2.10"
}
Type
ECOSYSTEM
Events
Introduced
1.3.0
Fixed
1.3.6
Database specific 
{
    "constraint": ">=1.3.0 <1.3.6"
}
Type
ECOSYSTEM
Events
Introduced
1.4.0
Fixed
1.4.3
Database specific 
{
    "constraint": ">=1.4.0 <1.4.3"
}
Type
ECOSYSTEM
Events
Introduced
1.5.0
Fixed
1.5.1
Database specific 
{
    "constraint": ">=1.5.0 <1.5.1"
}
Type
ECOSYSTEM
Events
Introduced
1.6.0
Fixed
1.6.4
Database specific 
{
    "constraint": ">=1.6.0 <1.6.4"
}

Database specific

affected_versions

"<1.2.10 || >=1.3.0 <1.3.6 || >=1.4.0 <1.4.3 || >=1.5.0 <1.5.1 || >=1.6.0 <1.6.4"