CVE-2025-31689

Overview

Drupal is an open-source content management system known for its flexibility, robust features, and strong community support. Organizations of all sizes use it to build and manage dynamic websites and web applications.

The GDPR Tasks sub-module within the GDPR module helps users organize the tasks necessary to secure a site. Some versions of this module permit malicious actors access to creating tasks without sufficient authorization; these tasks can become an avenue into the system.

The exploit was first found in the 3.x branch of the module; the fix was re-implemented to the Drupal 7 compatible version of the module available in the HeroDevs GDPR NES version.

Though no longer a named top-ten exploit in the OWASP top-ten list, cross-site request forgeries are part of Broken Access Control, which is a  top-ten OWASP vulnerability.

Malicious attackers use cross-site request forgery to cause a user to execute unwanted actions in which they have a valid, authenticated session. With a little help of social engineering (such as sending a link via email or chat), an attacker may trick the users of a web application into executing actions of the attacker’s choosing.

When a session is taken over, a CSRF attack can lead to:

• transferring funds
• modifying personal data, such as emails, telephone numbers and physical addresses
• additional nefarious activities.

 When the victim has administrator rights, an attack can compromise the entire web application.

‍

Details

Module Info

Project Page: https://drupal.org/project/gdpr

Affected Versions: >=7.0.0 <=7.1.0-alpha12

‍

Vulnerability Info

This medium-severity vulnerability is found in the Drupal GDPR Tasks submodule, which is shipped with the GDPR module. The exploit was first found in the 3.x branch of the module; the fix was re-implemented in the Drupal 7 compatible version of the module available in the HeroDevs GDPR NES version.

‍

Steps To Reproduce

1. Create a Drupal 7 installation and install a GDPR module version that is vulnerable to the exploit, such as 7.x-1.0-alpha12.
2. Also install Ctools, Views, Entity, and Checklistapi.
3. Enable the following modules:
   
   • Ctools, View, Entity, Checklistapi
   • General Data Protection Regulation (GDPR)
   • General Data Protection Regulation (GDPR) - Fields
   • General Data Protection Regulation (GDPR) - Obfuscated SQL Dump and
   • General Data Protection Regulation (GDPR) - Tasks.
4. Navigate to Administration > Configuration > GDPR > Checklist (/admin/config/gdpr/checklist). In that form:
   
   • Add a Multifile field from the drop-down.
   • On the next page, set the allowable uploads and note the allowable file size.
   • Save the field and save the form.
5. Click the View tab to go to node/1. 
6. Craft a file with a malicious name, such as:

"><img src=x onerror=alert('XSS')>.txt

‍

7. Upload the file. When the upload is complete, a dialog will appear (which shouldn’t).

‍

Credits

• Pierre Rudloff (prudloff)

‍

Addressing the Issue

Users of the affected component(s) should apply one of the following mitigations:

• Disable the module.
• Sign up for post-EOL security support; HeroDevs customers get immediate access to a patched version of this module.

‍

Additional Resources

• NIST
  https://nvd.nist.gov/vuln/detail/CVE-2025-31689
• Mitre
  https://www.cve.org/CVERecord?id=CVE-2025-31689
• Security Advisory for GDPR Tasks
  https://www.drupal.org/sa-contrib-2025-018

‍