From 9b06e074545251400cfe881af12366d1fae5e004 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Wed, 15 May 2024 20:44:25 +0000
Subject: [PATCH] Publish GHSA-7gwj-7fhm-vw4w

---
 .../GHSA-7gwj-7fhm-vw4w.json                  | 80 +++++++++++++++++++
 1 file changed, 80 insertions(+)
 create mode 100644 advisories/github-reviewed/2024/05/GHSA-7gwj-7fhm-vw4w/GHSA-7gwj-7fhm-vw4w.json

diff --git a/advisories/github-reviewed/2024/05/GHSA-7gwj-7fhm-vw4w/GHSA-7gwj-7fhm-vw4w.json b/advisories/github-reviewed/2024/05/GHSA-7gwj-7fhm-vw4w/GHSA-7gwj-7fhm-vw4w.json
new file mode 100644
index 00000000000..e7e92f2aeb6
--- /dev/null
+++ b/advisories/github-reviewed/2024/05/GHSA-7gwj-7fhm-vw4w/GHSA-7gwj-7fhm-vw4w.json
@@ -0,0 +1,80 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-7gwj-7fhm-vw4w",
+  "modified": "2024-05-15T20:43:00Z",
+  "published": "2024-05-15T20:43:00Z",
+  "aliases": [
+
+  ],
+  "summary": "Drupal core unrestricted file upload",
+  "details": "Drupal 8 core's file_save_upload() function does not strip the leading and trailing dot ('.') from filenames, like Drupal 7 did.\n\nUsers with the ability to upload files with any extension in conjunction with contributed modules may be able to use this to upload system files such as .htaccess in order to bypass protections afforded by Drupal's default .htaccess file.\n\nAfter this fix, file_save_upload() now trims leading and trailing dots from filenames.\n\n",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "drupal/core"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "8.0.0"
+            },
+            {
+              "fixed": "8.7.11"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "drupal/core"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "8.8.0"
+            },
+            {
+              "fixed": "8.8.1"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/2019-12-18-2.yaml"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/drupal/core"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.drupal.org/sa-core-2019-010"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-434"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-05-15T20:43:00Z",
+    "nvd_published_at": null
+  }
+}
\ No newline at end of file