DRUPAL-CONTRIB-2026-246

See a problem?
Import Source
https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/tinypng/DRUPAL-CONTRIB-2026-246.json
JSON Data
https://api.osv.dev/v1/vulns/DRUPAL-CONTRIB-2026-246
Published
2026-10-21T18:05:01Z
Modified
2026-10-21T18:45:02Z
Summary
[none]
Details

TinyPNG uses smart lossy compression techniques to reduce the file size of your PNG files.

The module doesn't sufficiently check access to image style derivatives when those files are served via a file stream other than private://.

This vulnerability is mitigated by the fact that Drupal must be configured to use a contributed (non-core) file scheme to serve private derived images.

References
Credits

Affected packages

Packagist:https://packages.drupal.org/8 / drupal/tinypng

Package

Name
drupal/tinypng
Purl
pkg:composer/drupal/tinypng?repository_url=https:%2F%2Fpackages.drupal.org%2F8

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.0.2
Database specific
Show details 
{
    "constraint":  "<2.0.2"
}

Database specific

affected_versions 
"<2.0.2"
source 
"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/tinypng/DRUPAL-CONTRIB-2026-246.json"