https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 15 Oct 2026 09:14:38 +0000 https://cve.radiocsirt.org/vuln/bdu:2022-04741 bdu:2022-04741 https://cve.radiocsirt.org/vuln/bdu:2022-04741 https://cve.radiocsirt.org/vuln/bit-drupal-2022-25277 <p><strong>Affected:</strong> Bitnami: drupal</p> <p>Drupal core sanitizes filenames with dangerous extensions upon upload (reference: SA-CORE-2020-012) and strips leading and trailing dots from filenames to prevent uploading server configuration files (reference: SA-CORE-2019-010). However, the protections for these two vulnerabilities previously did not work correctly together. As a result, if the site were configured to allow the upload of files with an htaccess extension, these files&#39; filenames would not be properly sanitized. This could allow bypassing the protections provided by Drupal core&#39;s default .htaccess files and possible remote code execution on Apache web servers. This issue is mitigated by the fact that it requires a field administrator to explicitly configure a file field to allow htaccess as an extension (a restricted permission), or a contributed module or custom code that overrides allowed file uploads.</p> <p><strong>Affected:</strong> Bitnami: drupal</p> <p>Drupal core sanitizes filenames with dangerous extensions upon upload (reference: SA-CORE-2020-012) and strips leading and trailing dots from filenames to prevent uploading server configuration files (reference: SA-CORE-2019-010). However, the protections for these two vulnerabilities previously did not work correctly together. As a result, if the site were configured to allow the upload of files with an htaccess extension, these files&#39; filenames would not be properly sanitized. This could allow bypassing the protections provided by Drupal core&#39;s default .htaccess files and possible remote code execution on Apache web servers. This issue is mitigated by the fact that it requires a field administrator to explicitly configure a file field to allow htaccess as an extension (a restricted permission), or a contributed module or custom code that overrides allowed file uploads.</p> https://cve.radiocsirt.org/vuln/bit-drupal-2022-25277 https://cve.radiocsirt.org/vuln/certfr-2022-avi-667 certfr-2022-avi-667 https://cve.radiocsirt.org/vuln/certfr-2022-avi-667 https://cve.radiocsirt.org/vuln/euvd-2026-213246 EUVD-2026-213246 https://cve.radiocsirt.org/vuln/euvd-2026-213246 https://cve.radiocsirt.org/vuln/fkie_cve-2022-25277 <p>Drupal core sanitizes filenames with dangerous extensions upon upload (reference: SA-CORE-2020-012) and strips leading and trailing dots from filenames to prevent uploading server configuration files (reference: SA-CORE-2019-010). However, the protections for these two vulnerabilities previously did not work correctly together. As a result, if the site were configured to allow the upload of files with an htaccess extension, these files&#39; filenames would not be properly sanitized. This could allow bypassing the protections provided by Drupal core&#39;s default .htaccess files and possible remote code execution on Apache web servers. This issue is mitigated by the fact that it requires a field administrator to explicitly configure a file field to allow htaccess as an extension (a restricted permission), or a contributed module or custom code that overrides allowed file uploads.</p> <p>Drupal core sanitizes filenames with dangerous extensions upon upload (reference: SA-CORE-2020-012) and strips leading and trailing dots from filenames to prevent uploading server configuration files (reference: SA-CORE-2019-010). However, the protections for these two vulnerabilities previously did not work correctly together. As a result, if the site were configured to allow the upload of files with an htaccess extension, these files&#39; filenames would not be properly sanitized. This could allow bypassing the protections provided by Drupal core&#39;s default .htaccess files and possible remote code execution on Apache web servers. This issue is mitigated by the fact that it requires a field administrator to explicitly configure a file field to allow htaccess as an extension (a restricted permission), or a contributed module or custom code that overrides allowed file uploads.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2022-25277 https://cve.radiocsirt.org/vuln/ghsa-6955-67hm-vjjq <p><strong>Affected:</strong> Packagist: drupal/core</p> <p>Drupal core sanitizes filenames with dangerous extensions upon upload and strips leading and trailing dots from filenames to prevent uploading server configuration files.</p> <p>However, the protections for these two vulnerabilities previously did not work correctly together. As a result, if the site were configured to allow the upload of files with an htaccess extension, these files&#39; filenames would not be properly sanitized. This could allow bypassing the protections provided by Drupal core&#39;s default .htaccess files and possible remote code execution on Apache web servers.</p> <p>This issue is mitigated by the fact that it requires a field administrator to explicitly configure a file field to allow htaccess as an extension (a restricted permission), or a contributed module or custom code that overrides allowed file uploads.</p> <p><strong>Affected:</strong> Packagist: drupal/core</p> <p>Drupal core sanitizes filenames with dangerous extensions upon upload and strips leading and trailing dots from filenames to prevent uploading server configuration files.</p> <p>However, the protections for these two vulnerabilities previously did not work correctly together. As a result, if the site were configured to allow the upload of files with an htaccess extension, these files&#39; filenames would not be properly sanitized. This could allow bypassing the protections provided by Drupal core&#39;s default .htaccess files and possible remote code execution on Apache web servers.</p> <p>This issue is mitigated by the fact that it requires a field administrator to explicitly configure a file field to allow htaccess as an extension (a restricted permission), or a contributed module or custom code that overrides allowed file uploads.</p> https://cve.radiocsirt.org/vuln/ghsa-6955-67hm-vjjq https://cve.radiocsirt.org/vuln/gsd-2022-25277 gsd-2022-25277 https://cve.radiocsirt.org/vuln/gsd-2022-25277 https://cve.radiocsirt.org/vuln/ubuntu-cve-2022-25277 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: drupal7, Ubuntu:Pro:16.04:LTS: drupal7</p> <p>Drupal core sanitizes filenames with dangerous extensions upon upload (reference: SA-CORE-2020-012) and strips leading and trailing dots from filenames to prevent uploading server configuration files (reference: SA-CORE-2019-010). However, the protections for these two vulnerabilities previously did not work correctly together. As a result, if the site were configured to allow the upload of files with an htaccess extension, these files&#39; filenames would not be properly sanitized. This could allow bypassing the protections provided by Drupal core&#39;s default .htaccess files and possible remote code execution on Apache web servers. This issue is mitigated by the fact that it requires a field administrator to explicitly configure a file field to allow htaccess as an extension (a restricted permission), or a contributed module or custom code that overrides allowed file uploads.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: drupal7, Ubuntu:Pro:16.04:LTS: drupal7</p> <p>Drupal core sanitizes filenames with dangerous extensions upon upload (reference: SA-CORE-2020-012) and strips leading and trailing dots from filenames to prevent uploading server configuration files (reference: SA-CORE-2019-010). However, the protections for these two vulnerabilities previously did not work correctly together. As a result, if the site were configured to allow the upload of files with an htaccess extension, these files&#39; filenames would not be properly sanitized. This could allow bypassing the protections provided by Drupal core&#39;s default .htaccess files and possible remote code execution on Apache web servers. This issue is mitigated by the fact that it requires a field administrator to explicitly configure a file field to allow htaccess as an extension (a restricted permission), or a contributed module or custom code that overrides allowed file uploads.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2022-25277