Drupal core Open Redirect vulnerabilityGHSA-6gf6-24h2-66j4
MEDIUMGHSA-6gf6-24h2-66j4 is a medium-severity (CVSS 4.3) vulnerability in drupal/core. A fix is available for drupal/core — see the affected versions and patch details below.
Real-World Exposure
drupal/coreReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.
Description
Drupal 7 has an Open Redirect vulnerability. For example, a user could be tricked into visiting a specially crafted link which would redirect them to an arbitrary external URL.
The vulnerability is caused by insufficient validation of the destination query parameter in the drupal_goto() function.
Other versions of Drupal core are not vulnerable.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐘Packagist | drupal/core | ≥ 7.0.0&&< 7.70 | 7.70composer require drupal/core:^7.70 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for drupal/core, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update drupal/core to 7.70 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-6gf6-24h2-66j4 is resolved across your whole dependency graph.
Workarounds
Stop reflecting attacker-controlled destinations: resolve every redirect target against an allowlist of paths or hosts you own, prefer a server-side key over a full URL in the request, and reject absolute URLs entirely where the flow only ever needs a relative one.
Frequently Asked Questions
Is GHSA-6gf6-24h2-66j4 in your dependencies?
Find it across Packagist, including transitive dependencies.