CVE-2010-1958: XSS
Cross-site scripting (XSS) vulnerability in the FileField module 5.x before 5.x-2.5 and 6.x before 6.x-3.4 for Drupal allows remote authenticated users, with create or edit permissions and 'Path to File' or 'URL to File' display enabled, to inject arbitrary web script or HTML via the file name (filepath parameter).
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
Which deployments are exposed?
Affected deployments are FileField 5.x before 5.x-2.5 and 6.x before 6.x-3.4 where either the 'Path to File' or 'URL to File' display option is enabled. The issue requires an authenticated user with permission to create or edit content.
What access does an attacker need?
An attacker must be able to authenticate and have create or edit permissions. They can inject script or HTML through a file name supplied using the filepath parameter.
Is a workaround available if patching cannot happen immediately?
The described exposure depends on the 'Path to File' or 'URL to File' display being enabled. Disabling those display options removes the stated condition required for exploitation; restricting create and edit permissions also limits who can exploit it.