- Backdrop Core 1.35.x versions prior to 1.35.2
- Backdrop Core 1.34.x versions prior to 1.34.6
Backdrop versions 1.33 and prior do not receive security coverage.
The Image module defines image fields and generates resized derivatives of uploaded images on demand.
The module never asks the file download access hook whether the requester may see the source image before generating and returning the derivative. A site that serves private images through a contributed stream wrapper therefore discloses those derivatives even if the backing store itself is not reachable over the web. The unauthorized request also writes a fresh derivative into that store.
This vulnerability is mitigated by the fact that Backdrop CMS must be configured to serve private derived images through a contributed file scheme rather than the core private scheme.
Update your site to the most recent version of Backdrop core. Download available on the Backdrop CMS 1.35.2 release page. See the update instructions.
- Jen Lampton of the Backdrop CMS Security Team
- Benji Fisher (benjifisher) of the Drupal Security Team
- Kim Pepper (kim.pepper)
- Mohit Aghera (mohit_aghera)
- Tag1 D7ES
- Jen Lampton of the Backdrop CMS Security Team
- Benji Fisher (benjifisher) of the Drupal Security Team
- catch (catch) of the Drupal Security Team
- Lee Rowlands (larowlan) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
- Tag1 D7ES