CVE-2025-13080: Drupal core - Moderately critical - Denial of Service - SA-CORE-2025-005
Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Drupal core allows Forceful Browsing. This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8.
Other sources
Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-13080?
CVE-2025-13080 is classified as a critical vulnerability due to its potential for forceful browsing attacks.
How do I fix CVE-2025-13080?
To mitigate CVE-2025-13080, upgrade Drupal core to versions 10.5.6, 11.1.9, or 11.2.8 or later.
What versions of Drupal are affected by CVE-2025-13080?
CVE-2025-13080 affects Drupal core versions from 8.0.0 before 10.4.9, 10.5.0 before 10.5.6, 11.0.0 before 11.1.9, and 11.2.0 before 11.2.8.
What type of vulnerability is CVE-2025-13080?
CVE-2025-13080 is an improper check for unusual or exceptional conditions vulnerability.
Can CVE-2025-13080 lead to data exposure?
Yes, CVE-2025-13080 can potentially allow unauthorized access to sensitive data through forceful browsing.