DRUPAL-CONTRIB-2021-033

    Dashboard / Vulnerabilities / DRUPAL-CONTRIB-2021-033

    DRUPAL-CONTRIB-2021-033

    Published: 22 Sept 2021Last Modified: 10 Sept 2026

    Summary:

    Details: This module enables you to extract the textual content of files for use on a website, e.g. to display it or use it in search indexes. The module doesn't sufficiently protect the administrator-defined commands that are executed on the server, which leads to post-authentication remote code execution by a limited set of users. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Administer File Extractor" to access the settings form. Sites are encouraged to review which roles have that permission and which users have that role, to ensure that only trusted users have that permission.

    References: https://www.drupal.org/sa-contrib-2021-033

    Affected packages

    Package

    Name: drupal/file_extractor

    Purl: pkg:composer/drupal/file_extractor?repository_url=https:%2F%2Fpackages.drupal.org%2F8

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -2.0.3

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    DRUPAL-CONTRIB-2021-033 | CVE-DB