—
DRUPAL-CONTRIB-2025-118
Details
The module provides instant integration of the official CKEditor 5 Premium plugins into the Drupal editor configuration.
This module has a path traversal vulnerability, which allows an access bypass to restricted image files in the system.
This access bypass is possible for any account with a *View published content* permission, but the risk is mitigated by the fact that only images can be opened.
Are you affected?
Enter the version of the package you're using.
Affected packages
Packagist:https://packages.drupal.org/8/drupal/ckeditor5_premium_features
Introduced in:
0Fixed in: 1.2.10Upgrade drupal/ckeditor5_premium_features to 1.2.10 or newer (ecosystem packagist:https://packages.drupal.org/8).