DRUPAL-CONTRIB-2023-053
DRUPAL-CONTRIB-2023-053
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The Xsendfile module enables fast transfer for private files in Drupal. In order to control private file downloads, the module overrides `ImageStyleDownloadController`, for which a vulnerability was disclosed in [SA-CORE-2023-005](https://www.drupal.org/sa-core-2023-005). The Xsendfile module was still based on an insecure version of `ImageStyleDownloadController`.
Fix available
- Published
- Updated
Stack: php
Affected products and versions
drupal/xsendfile Packagist:https://packages.drupal.org/8
- Affected ranges
- ECOSYSTEM: < 1.2.0
Update to 1.2.0