Project: 
Xsendfile
Project machine name: 
xsendfile
Date: 
2023-November-29
Security risk: 
Moderately critical 13 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:All
Vulnerability: 
Access bypass
Affected versions: 
<1.2.0
Description: 

The Xsendfile module enables fast transfer for private files in Drupal.

In order to control private file downloads, the module overrides ImageStyleDownloadController, for which a vulnerability was disclosed in SA-CORE-2023-005. The Xsendfile module was still based on an insecure version of ImageStyleDownloadController.

Solution: 

Install the latest version:

Reported By: 
Fixed By: 
Coordinated By: