CVE-2011-4972: Ckeditor

High severity, CVSS 7.5. EPSS: 1.7% chance of exploitation in the next 30 days.

hook_file_download in the CKEditor module 7.x-1.4 for Drupal does not properly restrict access to private files, which allows remote attackers to read private files via a direct request.

Affected products

• Ckeditor Ckeditor: version 7.x-1.4 only

Published 2019-11-13. Last modified 2026-06-16.