CVE-2023-31250

Name	CVE-2023-31250
Description	The file download facility doesn't sufficiently sanitize file paths in certain situations. This may result in users gaining access to private files that they should not have access to. Some sites may require configuration changes following this security release. Review the release notes for your Drupal version if you have issues accessing private files after updating.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
drupal7 (PTS)	jessie, jessie (lts)	7.32-1+deb8u19	vulnerable
	stretch (security), stretch (lts), stretch	7.52-2+deb9u18	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency
drupal7	source	jessie	(unfixed)	end-of-life
drupal7	source	stretch	(unfixed)	end-of-life
drupal7	source	(unstable)	(unfixed)

https://www.drupal.org/sa-core-2023-005