Threats tagged 'drupal-contrib-2026-292'

The Media alias display module in Drupal allows direct viewing of files via URL aliases, which can cause files to be served with a 'Cache-Control: public' header when they should not be cacheable. This may result in some users receiving cached versions of files containing information they should not access. The vulnerability is a follow-up to a previous advisory and is mitigated by proper Drupal configuration for non-public files and the requirement that an attacker must know to request a previously cached file accessed by a more privileged user.