DRUPAL-CONTRIB-2026-021unknown
DRUPAL-CONTRIB-2026-021
The advisory, in context
This module moves files to and from private storage depending on the access of its owning entities.
The module does not always validate the access logic correctly, resulting in files attached to an entity not being protected in certain circumstances.
This vulnerability is mitigated by the fact that saving an entity a second time resolves the issue.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
drupal/file_access_fix Packagist:https://packages.drupal.org/8
Ecosystem versions
Earlier releases before 1.2.0
Fixed in 1.2.0
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.2.0"
}
],
"type": "ECOSYSTEM",
"database_specific": {
"constraint": "<1.2.0"
}
}
],
"versions": []
}