CVE-2025-13080: 
PHP vulnerability analysis and mitigation

CVE-2025-13080 is an Improper Check for Unusual or Exceptional Conditions (CWE-754) vulnerability in Drupal core that enables Forceful Browsing attacks. It affects Drupal core versions from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, and from 11.2.0 before 11.2.8. The vulnerability was published on November 18, 2025, with patches released the same day. It carries a CVSS v3.1 base score of 5.3 (Medium) and a CVSS v4.0 score of 2.7 (Low) (Drupal Advisory, GitHub Advisory).

The root cause is classified as CWE-754 (Improper Check for Unusual or Exceptional Conditions), where Drupal core fails to adequately validate or handle unexpected user access attempts, enabling Forceful Browsing. Forceful Browsing is an attack technique where an attacker directly requests URLs or resources that are not linked from the application's normal navigation flow, bypassing intended access controls. No authentication or special privileges are required to exploit this vulnerability, and it is remotely exploitable over the network with low attack complexity. No public technical write-ups or proof-of-concept code have been identified at this time (GitHub Advisory, Drupal Advisory).

Successful exploitation could allow unauthenticated remote attackers to access restricted pages or functionality within a Drupal site that should be protected by access controls. The primary impact is on integrity (unauthorized access to restricted content or administrative areas), with no direct confidentiality or availability impact according to the CVSS v4.0 scoring. While the individual impact is rated low, exposure of restricted Drupal functionality could facilitate further reconnaissance or privilege escalation depending on site configuration (GitHub Advisory, Drupal Advisory).

There is no known public proof-of-concept exploit and no evidence of active in-the-wild exploitation as of the time of disclosure. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.039% (0.000390), placing it in the 26th percentile for exploitation likelihood within 30 days, indicating a low probability of near-term exploitation (GitHub Advisory).

Drupal has released patched versions addressing this vulnerability. Administrators should upgrade to one of the following fixed releases as soon as possible:

• 10.4.9 or later (for 8.0.0–10.4.x branch)
• 10.5.6 or later (for 10.5.x branch)
• 11.1.9 or later (for 11.0.x–11.1.x branch)
• 11.2.8 or later (for 11.2.x branch)

Additional hardening measures include implementing strict access controls, regularly auditing user permissions, and deploying a Web Application Firewall (WAF) to detect and block unusual browsing patterns (Drupal Advisory, GitHub Advisory).