{"id":"CVE-2016-3162","aliases":["GHSA-w2pj-c8x5-jvg2"],"url":"https://o3.security/vulnerability/CVE-2016-3162","summary":"Drupal File upload access bypass and denial of service","details":"The File module in Drupal 7.x before 7.43 and 8.x before 8.0.4 allows remote authenticated users to bypass access restrictions and read, delete, or substitute a link to a file uploaded to an unprocessed form by leveraging permission to create content or comment and upload files.","published":"2016-04-12T15:59:00.117Z","modified":"2026-07-08T05:49:08.218144040Z","cvss":{"score":8.1,"severity":"HIGH","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"drupal/core","fixedVersion":"7.43"},{"ecosystem":"Packagist","name":"drupal/core","fixedVersion":"8.0.4"},{"ecosystem":"Packagist","name":"drupal/drupal","fixedVersion":"8.0.4"},{"ecosystem":"Packagist","name":"drupal/drupal","fixedVersion":"7.43"}],"fix":null,"references":[{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2016/02/24/19"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2016/03/15/10"},{"type":"ADVISORY","url":"http://www.debian.org/security/2016/dsa-3498"},{"type":"FIX","url":"https://www.drupal.org/SA-CORE-2016-001"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-08T05:49:08.218144040Z"}}