AIKIDO-2025-10893
drupal/ckeditor5_premium_features is vulnerable to Access bypass
60
Medium Risk
This Affects:
drupal/ckeditor5_premium_featuresTL;DR
Affected versions of this package are vulnerable to access bypass: the module that integrates CKEditor 5 Premium plugins into Drupal exposes a path traversal vulnerability that lets users with only the *view published content* permission access restricted image files. The impact stays limited because only images can be opened.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
drupal/ckeditor5_premium_features is vulnerable to Access bypass in versions 0.0.1 - 1.2.9, 1.3.0 - 1.3.5, 1.4.0 - 1.4.2, 1.5.0 - 1.5.0 and 1.6.0 - 1.6.3.
How to fix this
Upgrade the drupal/ckeditor5_premium_features library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant