DRUPAL-CONTRIB-2020-035 The File Example submodule within the Examples project does not properly sanitize certain filenames as described in [SA-CORE-2020-012](https
The Drupal Examples module's File Example submodule fails to sanitize filenames, potentially allowing malicious file uploads and code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is DRUPAL-CONTRIB-2020-035?
DRUPAL-CONTRIB-2020-035 is a vulnerability in drupal/examples, published on 18 Nov 2020. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
The File Example submodule within the Examples project does not properly sanitize certain filenames as described in SA-CORE-2020-012, along with other related vulnerabilities.
Therefore, File Example so is being removed from Examples until a version demonstrating file security best practices can added back in the future.
Which versions are affected by DRUPAL-CONTRIB-2020-035?
Linux distribution packages (1)
drupal/examples Packagist:https://packages.drupal.org/8 | From 1.0.0 to 1.0.0 | None |
How do I fix DRUPAL-CONTRIB-2020-035?
No fix has been published for DRUPAL-CONTRIB-2020-035 yet. Limit exposure of the affected software until one is available.
Is DRUPAL-CONTRIB-2020-035 being exploited?
There is no known exploitation of DRUPAL-CONTRIB-2020-035 in the wild and no public exploit code.