{"id":"DRUPAL-CONTRIB-2018-027","details":"This module adds a new formatter for the file fields, which allows any file extension to be uploaded.  \nThe module doesn't sufficiently handle sanitization under the scenario uploaded SVG files.  \nThis vulnerability is mitigated by the fact that an attacker must have a role with the permission create or edit on certain content types that allows SVG files to be uploaded.","modified":"2025-12-10T23:30:55.750015Z","published":"2018-05-09T20:28:16Z","references":[{"type":"WEB","url":"https://www.drupal.org/sa-contrib-2018-027"}],"affected":[{"package":{"name":"drupal/svg_formatter","ecosystem":"Packagist:https://packages.drupal.org/8","purl":"pkg:composer/drupal/svg_formatter"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0"}],"database_specific":{"constraint":"\u003c1.6.0"}}],"database_specific":{"affected_versions":"\u003c1.6.0","source":"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/svg_formatter/DRUPAL-CONTRIB-2018-027.json"}}],"schema_version":"1.7.3","credits":[{"name":"Balazs Janos Tatar","contact":["https://www.drupal.org/user/649590"]}]}