CVE-2025-13083 Drupal core - Moderately critical - Information disclosure - SA-CORE-2025-008
An attacker can access sensitive information stored in the web browser cache due to incorrect access control configurations in Drupal core.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-13083?
CVE-2025-13083 is a low-severity vulnerability in Drupal Drupal, published on 18 Nov 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8, from 7.0 before 7.103.
Weakness: CWE-525
Which versions are affected by CVE-2025-13083?
12 open source packages ship an affected version, including drupal/core and drupal. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
drupal/core Packagist | From 10.5.0 | 10.5.6 |
drupal/core Packagist | From 10.5.0 | 10.5.6 |
drupal/core Packagist | From 11.0.0 | 11.1.9 |
drupal/core Packagist | From 11.0.0 | 11.1.9 |
drupal/core Packagist | From 11.2.0 | 11.2.8 |
drupal/core Packagist | From 11.2.0 | 11.2.8 |
6 more packages
drupal/core Packagist | From 7.0 | 7.103 |
drupal/core Packagist | From 7.0 | 7.103 |
drupal/core Packagist | From 8.0.0 | 10.4.9, 10.5.6, 11.1.9, 11.2.8 |
drupal/core Packagist | From 8.0.0 | 10.4.9 |
drupal/core Packagist | From 8.0.0 | 10.4.9 |
drupal Bitnami | From 8.0.0 | 10.4.9, 10.5.6, 11.1.9, 11.2.8 |
Products include Drupal Drupal.
How do I fix CVE-2025-13083?
Upgrade drupal/core to a fixed version for your release line: 10.5.6, 11.1.9, 11.2.8 or 7.103.
Is CVE-2025-13083 being exploited?
There is no known exploitation of CVE-2025-13083 in the wild and no public exploit code.
Other vulnerabilities in Drupal Drupal
Sources
Also known as BIT-drupal-2025-13083, DRUPAL-CORE-2025-008, GHSA-mhpg-hpj5-73r2.