Date
Severity
Critical
Vulnerability
Cross Site Scripting
Affected versions
<7.x-1.2

Description

The Taxonomy File Tree module builds a file browser for Organic Groups in which folders are taxonomy terms and files are nodes, and it renders that tree in a block, a page, and an AJAX response.

The module stores folder names exactly as they are entered on its folder add and edit forms and later prints those names into HTML links and a heading through its tft_l(), tft_li(), and folder menu template output without passing them through an output sanitiser, so a group member who can create or rename a folder can store markup that runs as script for everyone who later views the tree.

This vulnerability is mitigated by the fact that storing a payload requires a role with permission to add or edit folders within a group.

Solution

Install the latest version.

If you use the Taxonomy File Tree module for Drupal 7, upgrade to Taxonomy File Tree 7.x-1.2:


Reported by

Fixed by

  • Tag1 D7ES

Coordinated by

  • Tag1 D7ES