Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
Drupal 7 package can be misled by crafted tar files
published 1 month ago
Summary
The Drupal 7 package from cleanstart can be fooled by specially crafted archive files, potentially allowing unintended actions on your site. This could let an attacker place or run code you did not intend. Update to the latest version of the package or avoid extracting untrusted archives until the fix is applied.
What to do
- Update cleanstart drupal7 to version 7.78-r0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | drupal7 |
< 7.78-r0 Fix: upgrade to 7.78-r0
|
Original advisory text
Tar
Security vulnerability affects the drupal7 package. Tar.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published1 Oct 2026
Updated1 Oct 2026
First seen1 Oct 2026
Sources
CLEANSTART-2024-DI03393 · OSV
Track software like this
Free during beta