"It has been a pleasure to work with Casey, Rick and Phil from Ricochet. We were initially faced with a dip in productivity on our project due to some team member's contributing to DrupalCon Munich. Casey and team were able to step in, ramp up, and start contributing to solutions immediately. When our team members returned from Munich, we decided the Ricochet guys were too valuable and helpful to let go, so we have kept them on as members of the team until launch.
—Suzy Bates, Four Kitchens

File Entity (fieldable files) - Moderately critical - Information Disclosure - SA-CONTRIB-2024-040

Wed, 2024-09-11 09:38 — Anonymous (not verified)

Project: File Entity (fieldable files)Date: 2024-September-11Security risk: Moderately critical 10 ∕ 25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:DefaultVulnerability: Information DisclosureDescription: This module enables you to store and manage both private and public files, provides the ability to add fieldable metadata for file_entity bundle types in addition to core file_managed data.
The module doesn't sufficiently ensure private destination folders exist prior to writing to them. If the folder doesn't exist, the module places the file in a publicly accessible directory.
This vulnerability only affects sites with private files.Solution: Install the latest version:

If you use the file_entity module for Drupal 7, upgrade to file_entity 7.x-2.39 or newer.

Reported By:

Devin Zuczek

Fixed By:

Coordinated By:

Greg Knaddison of the Drupal Security Team
Damien McKenna of the Drupal Security Team
Juraj Nemec of the Drupal Security Team

Path to article https://www.drupal.org/sa-contrib-2024-040

Search form

File Entity (fieldable files) - Moderately critical - Information Disclosure - SA-CONTRIB-2024-040