| Package | Affected versions | Patched versions |
|---|---|---|
| drupal/datafield | < 2.0.14 | 2.0.14 |
Data Field allows you to create custom fields with multiple values under the default table form.
The file_uri formatter does not properly escape filenames when rendering links to uploaded files.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission to upload files into a Data Field file subfield.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free