CVE-2024-45440 is a medium-severity (CVSS 5.3) CWE-209 vulnerability in drupal/drupal. 1 public exploit or proof-of-concept reference is indexed, so weaponization risk is real. A fix is available for drupal/drupal — see the affected versions and patch details below.
Drupal Full Path Disclosure
Exploitation Status
No confirmed exploitation observed yet
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for CVE-2024-45440.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Real-World Exposure
drupal/drupal🐘drupal/drupal🐘drupal/core-recommended🐘drupal/core-recommended🐘drupal/core🐘drupal/core🐘drupal/drupal🐘drupal/core-recommended+1 moreReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.
Description
core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the value of hash_salt is file_get_contents of a file that does not exist.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐘Packagist | drupal/drupal | ≥ 10.3.0&&< 10.3.6 | 10.3.6composer require drupal/drupal:^10.3.6 |
| 🐘Packagist | drupal/drupal | ≥ 11.0.0&&< 11.0.5 | 11.0.5composer require drupal/drupal:^11.0.5 |
| 🐘Packagist | drupal/core-recommended | ≥ 10.3.0&&< 10.3.6 | 10.3.6composer require drupal/core-recommended:^10.3.6 |
| 🐘Packagist | drupal/core-recommended | ≥ 11.0.0&&< 11.0.5 | 11.0.5composer require drupal/core-recommended:^11.0.5 |
| 🐘Packagist | drupal/core | ≥ 10.3.0&&< 10.3.6 | 10.3.6composer require drupal/core:^10.3.6 |
| 🐘Packagist | drupal/core | ≥ 11.0.0&&< 11.0.5 | 11.0.5composer require drupal/core:^11.0.5 |
Affected Products
drupaldrupalResearch use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.
Drupal 11.x-dev - Full Path Disclosure
by Milad karimi · Apr 19, 2025
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for drupal/drupal, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update drupal/drupal to 10.3.6 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2024-45440 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How to detect CVE-2024-45440
A community-maintained Nuclei template exists for this CVE. You can scan for it directly:
nuclei -id cve-2024-45440 -u https://target- Template
- Drupal 11.x-dev - Full Path Disclosure
- Severity
- medium
- Impact
- Attackers can obtain full path disclosure information even when error logging is disabled.
- Remediation
- Configure hash_salt properly and ensure it references an existing file, or update to a patched Drupal version.
Template by ProjectDiscovery nuclei-templates (DhiyaneshDK), MIT licensed. View the full template. Scan only systems you are authorised to test.
Frequently Asked Questions
Is CVE-2024-45440 in your dependencies?
Find it across Packagist, including transitive dependencies.