CVE-2025-13080: Drupal core allows Forceful Browsing
Drupal core allows Forceful Browsing
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/coreto a version that resolves this vulnerability.Fixed in 11.2.8 - Upgrade
Upgrade
composer/drupal/coreto a version that resolves this vulnerability.Fixed in 11.1.9 - Upgrade
Upgrade
composer/drupal/coreto a version that resolves this vulnerability.Fixed in 10.5.6 - Upgrade
Upgrade
composer/drupal/coreto a version that resolves this vulnerability.Fixed in 10.4.9
Event History
Frequently Asked Questions
What is the severity of CVE-2025-13080?
CVE-2025-13080 is classified as a critical vulnerability due to its potential for forceful browsing attacks.
How do I fix CVE-2025-13080?
To mitigate CVE-2025-13080, upgrade Drupal core to versions 10.5.6, 11.1.9, or 11.2.8 or later.
What versions of Drupal are affected by CVE-2025-13080?
CVE-2025-13080 affects Drupal core versions from 8.0.0 before 10.4.9, 10.5.0 before 10.5.6, 11.0.0 before 11.1.9, and 11.2.0 before 11.2.8.
What type of vulnerability is CVE-2025-13080?
CVE-2025-13080 is an improper check for unusual or exceptional conditions vulnerability.
Can CVE-2025-13080 lead to data exposure?
Yes, CVE-2025-13080 can potentially allow unauthorized access to sensitive data through forceful browsing.