Vulnerability Directory | CVE-2025-13083 | Drupal 7

Overview

Drupal is an open-source content management system known for its flexibility, robust features, and strong community support. Organizations of all sizes use it to build and manage dynamic websites and web applications.

This issue is an information disclosure risk caused by missing Cache-Control headers on private file downloads. When responses are not explicitly marked as private or no-store, browsers or intermediary caches may store sensitive content. An attacker who can access a cached response (for example, via a shared workstation, proxy, or browser history) may be able to view content that should only be available to authenticated users.

Information exposure, often referred to as information disclosure or sensitive data exposure, is a high-severity vulnerability where applications inadvertently reveal confidential or useful details to unauthorized parties due to inadequate protections, such as weak cryptography, misconfigurations, or flawed access controls. According to OWASP, this can stem from transmitting data in clear text, using outdated cryptographic algorithms, improper key management, or failing to sanitize error messages and responses, allowing attackers to intercept, infer, or directly access information like configurations, server details, user credentials, or API keys. It aligns with OWASP Top 10 categories including A01:2021 – Broken Access Control (ranked first) and A05:2021 – Security Misconfiguration (ranked fifth), as well as evolving from the 2017 A3: Sensitive Data Exposure, now encompassed in A02:2021 – Cryptographic Failures (ranked second). Attackers exploit this through techniques like network sniffing, analyzing error outputs, or leveraging misconfigured endpoints, potentially leading to escalated attacks.

Ramifications include:

Data breaches
Identity theft
Financial losses
Further exploits
Legal penalties, and
Reputational damage.

This issue affects all versions of Drupal 7 equal to or lower than 7.103 and is patched in Drupal 7 NES version 7.103.12.

‍

Details

Module Info

Product: Drupal
Affected code: Drupal 7 Core, includes/file.inc
Affected versions: >=7.0 <=7.103
Project page: https://drupal.org/project/drupal
Fixed in: Drupal 7 NES 7.103.12

‍

Vulnerability Info

This low-severity vulnerability is found in all versions of Drupal 7 equal to or lower than 7.103.

If a module doesn’t set Cache-Control, the core now defaults to private (or public only for explicitly configured public schemes via file_additional_public_schemes).

‍

Steps To Reproduce

Set up a version of Drupal 7 in which the exploit is present (<= 7.103). Ensure the private file system is configured (ensure the directory exists and is writable by the web server user).
Go to Admin > Structure > Content types > Add content type and add a File field. Set its storage destination to Private files.
Create a node with a private file attachment that is restricted to authenticated users.
Log in as an authenticated user and open the file by clicking the attachment (confirm it downloads successfully).
Inspect the response headers for the download (use the dev tools in the browser or curl -I on the file URL) and confirm no Cache-Control header is present.
Log out and revisit the file URL via browser history/back or reload.
Observe the file can be served from cache (e.g., “from disk cache” in DevTools), despite lack of permission.

‍

Addressing the Issue

Users of the affected component(s) should address this exploit in one of the following ways:

Add web server rules for private file paths to force Cache-Control: private, no-store and Pragma: no-cache (e.g., on system/files or your private scheme route).
Configure reverse proxies/CDNs to bypass caching for authenticated requests and for private file endpoints.
Require authentication for any file downloads that could include sensitive data; ensure access checks are enforced before returning headers.
However, the above may not deter determined attackers and have trade-offs. Consider signing up for post-EOL security support; HeroDevs customers get immediate access to a patched version of Drupal 7 core.

‍