Description
Directory traversal vulnerability in the Avatar Uploader module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.0-beta6 for Drupal allows remote authenticated users to read arbitrary files via a .. (dot dot) in the path of a cropped picture in the uploader panel.
References (3)
Core 3
Core References
Patch x_refsource_confirm
https://www.drupal.org/node/2330763
Patch x_refsource_confirm
https://www.drupal.org/node/2330759
Vendor Advisory x_refsource_misc
https://www.drupal.org/node/2332169
Scores
EPSS
0.0148
EPSS Percentile
70.8%
Details
CWE
CWE-22
Status
published
Products (4)
avatar_uploader_project/avatar_uploader
6.x-1.0
avatar_uploader_project/avatar_uploader
6.x-1.1
avatar_uploader_project/avatar_uploader
7.x-1.0 beta1 (4 CPE variants)
avatar_uploader_project/avatar_uploader
7.x-1.x-dev
Published
Dec 01, 2014
Tracked Since
Feb 18, 2026