drupal/fancy_file_delete - SA-CONTRIB-2022-023
This module enables you to manage and delete files.
The module doesn't sufficiently protect unmanaged files from view under the scenario unauthenticated user knows path to visit the view and can attempt to delete files which results in duplicate files being created.
To mitigate this issue without deploying code, review all views that are based on Fancy File Delete and ensure they have an access control set to use the permission "administer unmanaged files entities".
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | drupal/fancy_file_delete | < 2.0.7 | 2.0.7 |
| Drupal module | drupal/fancy_file_delete | < 2.0.7 | 2.0.7 |
References
- Weakness (CWE)
-- Platform
- Composer, Drupal
- Package
drupal/fancy_file_delete- Disclosed
- 09.02.2022
- Updated
- 11.10.2026 12:18
Sources and licenses
OSV / GitHub Advisory Database - DRUPAL-CONTRIB-2022-023 - CC BY-SA 2.0; code GPL-2.0-or-later
Vulnerability history: drupal/fancy_file_delete
All published vulnerabilities of this package (Drupal module), newest first. Shows whether this is a one-off slip or a package that needs watching.
This is the only known vulnerability of this package.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.