What’s Vulnerable › Vulnerabilities

CVE-2017-6921: File REST resource does not properly validate

• Severity: medium (CVSS 5.9 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-01-15 · updated 2026-06-17
• Weakness: CWE-20

Description

In Drupal 8 prior to 8.3.4; The file REST resource does not properly validate some fields when manipulating files. A site is only affected by this if the site has the RESTful Web Services (rest) module enabled, the file REST resource is enabled and allows PATCH requests, and an attacker can get or register a user account on the site with permissions to upload files and to modify the file resource.

Affected products

• Drupal: from 8.0.0 before 8.3.4 — fixed in 8.3.4

How to fix

Upgrade to a fixed version: Drupal 8.3.4. Check the vendor advisory for mitigations.

References

• http://www.securityfocus.com/bid/99222
• http://www.securitytracker.com/id/1038781
• https://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2017-06-21/drupal-core-multiple
• http://www.securityfocus.com/bid/99222
• http://www.securitytracker.com/id/1038781
• https://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2017-06-21/drupal-core-multiple

Get alerted when CVE-2017-6921 or the next vulnerability affects your stack