Drupal core unrestricted file upload
Published 15 May 2024 · Updated 29 Nov 2024
Affected packages
- Affected
- >=8.0.0 <8.7.11
- Fixed in
- 8.7.11
composer require drupal/core:^8.7.11- Affected
- >=8.8.0 <8.8.1
- Fixed in
- 8.8.1
composer require drupal/core:^8.8.1Details
Drupal 8 core's file_save_upload() function does not strip the leading and trailing dot ('.') from filenames, like Drupal 7 did.
Users with the ability to upload files with any extension in conjunction with contributed modules may be able to use this to upload system files such as .htaccess in order to bypass protections afforded by Drupal's default .htaccess file.
After this fix, file_save_upload() now trims leading and trailing dots from filenames.
Is GHSA-7gwj-7fhm-vw4w in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected drupal/core, and gives you the command that fixes it.
References
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.