| Package | Affected versions | Patched versions |
|---|---|---|
| drupal/postfile | < 1.0.2 | 1.0.2 |
| post file | < 1.0.2 | 1.0.2 |
The module creates an endpoint on the site at /postfile/upload that accepts a POST request for uploading a single file into a specified file system (public, private, etc).
This module accepts any uploaded file extension, including dangerous file formats so it can be used to bypass the allow_insecure_uploads config.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission "postfile upload".
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free