CVE-2017-6928

CVE-2017-6928 is an access bypass vulnerability affecting Drupal core versions prior to 7.57 when utilizing the private file system. It occurs in specific, unusual site configurations where conflicting module permissions for file access lead to an unauthorized user being able to view or download private files. The vulnerability has a CVSS v3 score of 5.3 (Medium), indicating a network-based attack with high impact on confidentiality, but requiring low privileges and high attack complexity. While it allows for unauthorized access to sensitive information, it does not impact integrity or availability. There is no evidence of active exploitation, no known public exploit code (Metasploit, Nuclei, ExploitDB), and minimal community discussion or media coverage, suggesting a low current threat level.