CVE-2024-13265 Opigno Learning path - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-029
Attackers can execute arbitrary PHP code via static code injection in the Opigno Learning path module for Drupal.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-13265?
CVE-2024-13265 is a high-severity code injection vulnerability in Drupal Opigno Learning path, published on 9 Jan 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno Learning path allows PHP Local File Inclusion.This issue affects Opigno Learning path: from 0.0.0 before 3.1.2.
Weakness: CWE-96
Which versions are affected by CVE-2024-13265?
It affects 1 product.
Linux distribution packages (1)
drupal/opigno_learning_path Packagist:https://packages.drupal.org/8 | All versions | 3.1.2 |
Products include Opigno Learning Path.
How do I fix CVE-2024-13265?
Upgrade to a fixed version.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2024-13265 being exploited?
There is no known exploitation of CVE-2024-13265 in the wild and no public exploit code.
Sources
Also known as DRUPAL-CONTRIB-2024-029, GHSA-2rx4-vrv5-3mjp.