Description
The Taxonomy File Tree module builds a file browser for Organic Groups in which folders are taxonomy terms and files are nodes, and it renders that tree in a block, a page, and an AJAX response.
The module stores folder names exactly as they are entered on its folder add and edit forms and later prints those names into HTML links and a heading through its tft_l(), tft_li(), and folder menu template output without passing them through an output sanitiser, so a group member who can create or rename a folder can store markup that runs as script for everyone who later views the tree.
This vulnerability is mitigated by the fact that storing a payload requires a role with permission to add or edit folders within a group.
Solution
Install the latest version.
If you use the Taxonomy File Tree module for Drupal 7, upgrade to Taxonomy File Tree 7.x-1.2:
Reported by
Fixed by
- Tag1 D7ES
Coordinated by
- Tag1 D7ES