GHSA-7f4f-p7mq-p4fv
Drupal External URL injection through URL aliases leading to Open Redirect
The path module in Drupal allows users with the 'administer paths' to create pretty URLs for content. In certain circumstances the user can enter a particular path that triggers an open redirect to a malicious url.
What each source reports
GitHub AdvisoriesNo score
Drupal External URL injection through URL aliases leading to Open Redirect
The path module in Drupal allows users with the 'administer paths' to create pretty URLs for content. In certain circumstances the user can enter a particular path that triggers an open redirect to a malicious url.
- Record
GHSA-7f4f-p7mq-p4fv- Weakness
- CWE-601
- Updated
- 2026-11-02
OSVNo score
Drupal External URL injection through URL aliases leading to Open Redirect
The path module in Drupal allows users with the 'administer paths' to create pretty URLs for content. In certain circumstances the user can enter a particular path that triggers an open redirect to a malicious url.
- Record
GHSA-7f4f-p7mq-p4fv- Weakness
- CWE-601
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal/corePackagist | 7.0 up to 7.60 | 7.60 |
drupal/corePackagist | 8.0.0 up to 8.5.8 | 8.5.8 |
drupal/corePackagist | 8.6.0 up to 8.6.2 | 8.6.2 |
drupal/corePackagist | 8.0.0 up to 8.5.8, plus listed versions 8.0.18.0.28.0.38.0.48.0.5 Show 45 moreShow less8.0.68.1.08.1.0-beta18.1.0-beta28.1.0-rc18.1.18.1.108.1.28.1.38.1.48.1.58.1.68.1.78.1.88.1.98.2.08.2.0-beta18.2.0-beta28.2.0-beta38.2.0-rc18.2.0-rc28.2.18.2.28.2.38.2.48.2.58.2.68.2.78.2.88.3.08.3.0-alpha18.3.0-beta18.3.0-rc18.3.0-rc28.3.18.3.28.3.38.3.48.3.58.3.68.3.78.3.88.3.98.4.08.4.0-alpha1 | 8.5.8 |
drupal/corePackagist | 8.6.0 up to 8.6.2, plus listed versions 8.6.1 | 8.6.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-7f4f-p7mq-p4fv is a vulnerability with no CVSS score yet in drupal/core, published May 15, 2024. No source lists public exploit code. Fixed in drupal/core 7.60.
References
Left out here: 22 versions. The JSON record has them.