DRUPAL-CONTRIB-2023-053
The Xsendfile module enables fast transfer for private files in Drupal.
In order to control private file downloads, the module overrides ImageStyleDownloadController, for which a vulnerability was disclosed in SA-CORE-2023-005. The Xsendfile module was still based on an insecure version of ImageStyleDownloadController.
What each source reports
OSV No score
The Xsendfile module enables fast transfer for private files in Drupal.
In order to control private file downloads, the module overrides ImageStyleDownloadController, for which a vulnerability was disclosed in SA-CORE-2023-005. The Xsendfile module was still based on an insecure version of ImageStyleDownloadController.
- Record
DRUPAL-CONTRIB-2023-053- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal/xsendfilePackagist:https://packages.drupal.org/8 |
before 1.2.0 | 1.2.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
DRUPAL-CONTRIB-2023-053 is a vulnerability with no CVSS score yet in drupal/xsendfile, published November 29, 2023. No source lists public exploit code. Fixed in drupal/xsendfile 1.2.0.