Project: 
POST File
Date: 
2024-November-13
Security risk: 
Moderately critical 12 ∕ 25 AC:Complex/A:None/CI:None/II:Some/E:Theoretical/TD:All
Vulnerability: 
Cross Site Request Forgery
Affected versions: 
<1.0.2
CVE IDs: 
CVE-2024-13293
Description: 

The module creates an endpoint on the site at /postfile/upload that accepts a POST request for uploading a single file into a specified file system (public, private, etc).

The module doesn't sufficiently protect against Cross Site Request Forgery
under allowing an attacker to trick a site user into uploading a file.

Solution: 

Install the latest version:

  • If you use the POST File module for Drupal 10.3.x/11.x, upgrade to Post File 1.0.2
Reported By: 
Fixed By: 
Coordinated By: