Drupal Malicious file upload with filenames stating with dot
Summary
GHSA-58xv-7h9r-mx3c: Drupal Malicious file upload with filenames stating with dot. Affects drupal/drupal across 2 version ranges.
>= 8.0.0, < 8.7.11
>= 8.8.0, < 8.8.1
Fixed in 8.7.11 or 8.8.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Drupal 8 core's file_save_upload() function does not strip the leading and trailing dot ('.') from filenames, like Drupal 7 did.
Users with the ability to upload files with any extension in conjunction with contributed modules may be able to use this to upload system files such as .htaccess in order to bypass protections afforded by Drupal's default .htaccess file.
After this fix, file_save_upload() now trims leading and trailing dots from filenames.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 8.0.0, < 8.7.118.7.11composer require drupal/drupal:8.7.11 -
>= 8.8.0, < 8.8.18.8.1composer require drupal/drupal:8.8.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/drupal.
