SA-CONTRIB-2026-338: Critical severity composer/drupal/file_resup vulnerability
This module adds large file, multiple file, and resumable uploads to the File and Image field widgets. The module doesn't sufficiently check access to resumable upload forms. This allows an unauthenticated user to start uploads against forms they are not permitted to use, and to store partial upload data on the server. This vulnerability is mitigated by the fact that partial upload data is only attached to content through the normal entity form, which enforces its own access checks, and that stored partial upload data is not executable by the web server.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/file_resupto a version that resolves this vulnerability.Fixed in 2.0.6
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated user can start resumable uploads against forms they are not permitted to use. Exploitation allows partial upload data to be stored on the server.
Can an attacker use this to attach uploaded data to content without authorization?
No. Partial upload data is attached to content only through the normal entity form, which enforces its own access checks.
Is stored partial upload data executable by the web server?
No. The stored partial upload data is not executable by the web server.