GHSA-r67r-42wx-c8r7
Drupal External URL injection through URL aliases leading to Open Redirect
GHSA-r67r-42wx-c8r7 is a vulnerability with no CVSS score yet in drupal/drupal, published May 15, 2024. No source lists public exploit code. Fixed in drupal/drupal 7.60.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
7.60drupal/drupal +4 more
Description
The path module in Drupal allows users with the 'administer paths' to create pretty URLs for content. In certain circumstances the user can enter a particular path that triggers an open redirect to a malicious url.
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal/drupalPackagist | 7.0 up to 7.60 | 7.60 |
drupal/drupalPackagist | 8.0.0 up to 8.5.8 | 8.5.8 |
drupal/drupalPackagist | 8.6.0 up to 8.6.2 | 8.6.2 |
drupal/drupalPackagist | 8.0.0 up to 8.5.8, plus listed versions 8.0.18.0.28.0.38.0.48.0.5 Show 45 moreShow less8.0.68.1.08.1.0-beta18.1.0-beta28.1.0-rc18.1.18.1.108.1.28.1.38.1.48.1.58.1.68.1.78.1.88.1.98.2.08.2.0-beta18.2.0-beta28.2.0-beta38.2.0-rc18.2.0-rc28.2.18.2.28.2.38.2.48.2.58.2.68.2.78.2.88.3.08.3.0-alpha18.3.0-beta18.3.0-rc18.3.0-rc28.3.18.3.28.3.38.3.48.3.58.3.68.3.78.3.88.3.98.4.08.4.0-alpha1 | 8.5.8 |
drupal/drupalPackagist | 8.6.0 up to 8.6.2, plus listed versions 8.6.1 | 8.6.2 |
What each source reports
GitHub AdvisoriesNo score
Drupal External URL injection through URL aliases leading to Open Redirect
The path module in Drupal allows users with the 'administer paths' to create pretty URLs for content. In certain circumstances the user can enter a particular path that triggers an open redirect to a malicious url.
- Record
GHSA-r67r-42wx-c8r7- Weakness
- CWE-601
- Updated
- 2026-11-02
OSVNo score
Drupal External URL injection through URL aliases leading to Open Redirect
The path module in Drupal allows users with the 'administer paths' to create pretty URLs for content. In certain circumstances the user can enter a particular path that triggers an open redirect to a malicious url.
- Record
GHSA-r67r-42wx-c8r7- Weakness
- CWE-601
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
Left out here: 22 versions. The JSON record has them.