DRUPAL-CONTRIB-2024-059

Import Source

https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/postfile/DRUPAL-CONTRIB-2024-059.json

JSON Data

https://api.osv.dev/v1/vulns/DRUPAL-CONTRIB-2024-059

Aliases

CVE-2024-13293

Published

2024-11-13T17:36:48Z

Modified

2025-12-10T23:41:25.957744Z

Summary

[none]

Details

The module creates an endpoint on the site at /postfile/upload that accepts a POST request for uploading a single file into a specified file system (public, private, etc).

The module doesn't sufficiently protect against Cross Site Request Forgery
under allowing an attacker to trick a site user into uploading a file.

References

https://www.drupal.org/sa-contrib-2024-059

Credits

- Pierre Rudloff
- - https://www.drupal.org/user/3611858

Affected packages

Packagist:https://packages.drupal.org/8 / drupal/postfile

Package

Name: drupal/postfile
Purl: pkg:composer/drupal/postfile

Affected ranges

Type

ECOSYSTEM

Events

Introduced

Fixed

1.0.2

Database specific

{
    "constraint": "<1.0.2"
}

Database specific

source

"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/postfile/DRUPAL-CONTRIB-2024-059.json"

affected_versions

"<1.0.2"