CVE-2017-6381

A 3rd party development library including with Drupal 8 development dependencies is vulnerable to remote code execution. This is mitigated by the default .htaccess protection against PHP execution, and the fact that Composer development dependencies aren't normal installed. You might be vulnerable to this if you are running a version of Drupal before 8.2.2. To be sure you aren't vulnerable, you can remove the <siteroot>/vendor/phpunit directory from your production deployments

• CWE-829

• http://www.securityfocus.com/bid/96919Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1038058
• https://www.drupal.org/SA-2017-001Mitigation, Vendor Advisory
• http://www.securityfocus.com/bid/96919Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1038058
• https://www.drupal.org/SA-2017-001Mitigation, Vendor Advisory

Published

Mar 16, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-6367In Cerberus FTP Server 8.0.10.1, a crafted HTTP request caus…
• CVE-2017-6369Insufficient checks in the UDF subsystem in Firebird 2.5.x b…8.8
• CVE-2017-6370TYPO3 7.6.15 sends an http request to an index.php?loginProv…
• CVE-2017-6371Synchronet BBS 3.16c for Windows allows remote attackers to …7.5
• CVE-2017-6377When adding a private file via the editor in Drupal 8.2.x be…
• CVE-2017-6379Some administrative paths in Drupal 8.2.x before 8.2.7 did n…
• CVE-2017-6383Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2017-6384Memory leak in the login_user function in saslserv/main.c in…
• CVE-2017-6386Memory leak in the vrend_create_vertex_elements_state functi…6.5
• CVE-2017-6387The dex_loadcode function in libr/bin/p/bin_dex.c in radare2…
• CVE-2017-6390An issue was discovered in whatanime.ga before c334dd8499a68…
• CVE-2017-6391An issue was discovered in Kaltura server Lynx-12.11.0. The …