CVE-2024-13276

The File Entity (fieldable files) module in the Drupal CMS (versions 7.X-* before 7.X-2.39) is vulnerable to Forceful Browsing due to an Insertion of Sensitive Information Into Sent Data issue. The root cause is that the module fails to verify the existence of folders within the private destinati...