Drupal Drama: The Full Path Disclosure Debacle of 2025!
Drupal 11.x-dev is at it again with a full path disclosure exploit, proving once more that even error logging can’t hide its secrets. Core/authorize.php is the culprit, and it’s not shy about it. With CVE-2024-45440, remember: knowledge is power, but misuse might land you in hot water. Use wisely!
Hot Take:
Looks like Drupal 11.x-dev got caught with its pants down, revealing more than just its code. Thanks to a little oversight, it’s now the proud feature of a Full Path Disclosure vulnerability. I guess it’s true what they say: even seasoned developers sometimes leave their doors wide open—metaphorically (and sometimes literally).
Key Points:
- Drupal 11.x-dev has a Full Path Disclosure vulnerability.
- The issue is triggered by accessing core/authorize.php.
- Error logging settings won’t protect you from this disclosure.
- The vulnerability is tracked as CVE-2024-45440.
- It’s a reminder to keep an eye on those ‘harmless’ development versions.
Already a member? Log in here