DRUPAL-CONTRIB-2018-027
This module adds a new formatter for the file fields, which allows any file extension to be uploaded.
The module doesn't sufficiently handle sanitization under the scenario uploaded SVG files.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission create or edit on certain content types that allows SVG files to be uploaded.
What each source reports
OSV No score
This module adds a new formatter for the file fields, which allows any file extension to be uploaded.
The module doesn't sufficiently handle sanitization under the scenario uploaded SVG files.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission create or edit on certain content types that allows SVG files to be uploaded.
- Record
DRUPAL-CONTRIB-2018-027- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal/svg_formatterPackagist:https://packages.drupal.org/8 |
before 1.6.0 | 1.6.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
DRUPAL-CONTRIB-2018-027 is a vulnerability with no CVSS score yet in drupal/svg_formatter, published May 9, 2018. No source lists public exploit code. Fixed in drupal/svg_formatter 1.6.0.