—
DRUPAL-CONTRIB-2026-066
상세
The Canvas module allow you to upload image files via a custom API.
The validation rules check the file extension of the uploaded file but not the file MIME type. This may allow a malicious user to upload a file that is not an image.
Certain web-server configurations may serve the uploaded file with its actual MIME type rather than an image type. This may lead to cross-site scripting (XSS) or other unexpected behavior.
이 버전이 영향받나요?
사용 중인 패키지 버전을 입력하면 즉시 평가합니다.
영향 패키지
Packagist:https://packages.drupal.org/8 / drupal/canvas
최초 영향 버전:
0 수정 버전: 1.4.2 Upgrade drupal/canvas to 1.4.2 or newer (ecosystem packagist:https://packages.drupal.org/8).