File Entity (fieldable files) - Moderately critical - Cross Site Scripting, Access bypass - SA-CONTRIB-2024-001

Project: File Entity (fieldable files)Date: 2024-January-10Security risk: Moderately critical 14∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross Site Scripting, Access bypassDescription: File entity provides interfaces for managing files. It also extends the core file entity, allowing files to be fieldable, grouped into types, viewed (using display modes) and formatted using field formatters.
The module previously did not sufficiently validate files under the scenario of a file replacement leading to multiple exploit paths including persistent Cross Site Scripting.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission to edit files.Solution: Install the latest version:

Reported By: 

Fixed By: 

Coordinated By: 

Path to article