Threats tagged 'drupal-contrib-2026-338'

The File resup module for Drupal allows large, multiple, and resumable file uploads but does not sufficiently check access to resumable upload forms. This permits unauthenticated users to initiate uploads on forms they should not access and store partial upload data on the server. However, partial upload data is only linked to content via the normal entity form, which enforces access controls, and the stored data is not executable by the web server. The vulnerability is fixed in version 2.0.6.