CVE-2026-126747: Composer/drupal/file_resup vulnerability
This module adds large file, multiple file, and resumable uploads to the File and Image field widgets.
The module doesn't sufficiently check access to resumable upload forms. This allows an unauthenticated user to start uploads against forms they are not permitted to use, and to store partial upload data on the server.
This vulnerability is mitigated by the fact that partial upload data is only attached to content through the normal entity form, which enforces its own access checks, and that stored partial upload data is not executable by the web server.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/file_resupto a version that resolves this vulnerability.Fixed in 2.0.6
Event History
Frequently Asked Questions
What can an unauthenticated attacker do?
An unauthenticated attacker can start resumable uploads against forms they are not authorized to use and cause partial upload data to be stored on the server. The partial data is not attached to content unless it is submitted through the normal entity form.
Can this be used to publish unauthorized content or execute uploaded files?
The available information indicates that normal entity-form access checks still control attachment of partial upload data to content. Stored partial upload data is also not executable by the web server.
What is the practical impact if exploitation occurs?
The direct impact described is unauthorized creation of partial upload data on the server. This could expose affected systems to unwanted storage consumption, even though the data cannot be directly attached to content or executed based on the information provided.