Description
The RESTful module turns Drupal into a RESTful server and exposes a file-upload data provider that lets clients POST files into entity-backed file resources.
The module doesn't verify that an upload destined for an image-only resource is actually an image: it validates uploads by file extension only and performs no content check, so a file whose contents are HTML/JavaScript but whose name ends in an image extension passes validation and is saved at a public URI.
This vulnerability is mitigated by the fact that exploitation requires a file-upload resource that is enabled and restricted to image extensions, plus a user with permission to upload to it, and that the file is normally served with an image content-type, which limits direct script execution in modern browsers. This is the Drupal 7 contrib equivalent of the core fix SA-CORE-2026-009 / CVE-2026-55808.
Solution
Install the latest version.
If you use the RESTful module for Drupal 7, upgrade to RESTful 7.x-1.11 or 7.x-2.18:
Reported by
Fixed by
- Tag1 D7ES
Coordinated by
- Tag1 D7ES