—
DRUPAL-CONTRIB-2024-060
Details
The module creates an endpoint on the site at /postfile/upload that accepts a POST request for uploading a single file into a specified file system (public, private, etc).
This module accepts any uploaded file extension, including dangerous file formats so it can be used to bypass the allow\_insecure\_uploads config.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission "postfile upload".
Are you affected?
Enter the version of the package you're using.
Affected packages
Packagist:https://packages.drupal.org/8/drupal/postfile
Introduced in:
0Fixed in: 1.0.2Upgrade drupal/postfile to 1.0.2 or newer (ecosystem packagist:https://packages.drupal.org/8).