DRUPAL-CONTRIB-2022-023
This module enables you to manage and delete files.
The module doesn't sufficiently protect unmanaged files from view under the scenario unauthenticated user knows path to visit the view and can attempt to delete files which results in duplicate files being created.
To mitigate this issue without deploying code, review all views that are based on Fancy File Delete and ensure they have an access control set to use the permission "administer unmanaged files entities".
What each source reports
OSV No score
This module enables you to manage and delete files.
The module doesn't sufficiently protect unmanaged files from view under the scenario unauthenticated user knows path to visit the view and can attempt to delete files which results in duplicate files being created.
To mitigate this issue without deploying code, review all views that are based on Fancy File Delete and ensure they have an access control set to use the permission "administer unmanaged files entities".
- Record
DRUPAL-CONTRIB-2022-023- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal/fancy_file_deletePackagist:https://packages.drupal.org/8 |
before 2.0.7 | 2.0.7 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
DRUPAL-CONTRIB-2022-023 is a vulnerability with no CVSS score yet in drupal/fancy_file_delete, published February 9, 2022. No source lists public exploit code. Fixed in drupal/fancy_file_delete 2.0.7.