Looking for a fix? Check your Codebase security with multiple scanners from

Edit Report

Our sensors found this exploit at:

Below is a copy:

Drupal Webform Multiple File Upload - Remote code executionAdvisory ID: DRUPAL-SA-CONTRIB-2016-038
Project: Webform Multiple File Upload (third-party module)
Version: 7.x
Date: 2016-July-13
Security risk: 17/25 ( Critical) AC:Basic/A:User/CI:All/II:All/E:Theoretical/TD:Default
Vulnerability: Arbitrary PHP code execution

The Webform Multiple File Upload module allows users to upload multiple files on a Webform.
The Webform Multifile File Upload module contains a Remote Code Execution (RCE) vulnerability where form inputs will be unserialized and a specially crafted form input may trigger arbitrary code execution depending on the libraries available on a site.
This vulnerability is mitigated by the fact that an attacker must have the ability to submit a Webform with a Multiple File Input field. Further, a site must have an object defined with methods that are invoked at wake/destroy that include code that can be leveraged for malicious purposes. Drupal 7 Core contains one such class which can be used to delete arbitrary files, but contributed or custom classes may include methods that can be leveraged for RCE.

Note: this vulnerability exists in the Webform Multiple File Upload (webform_multifile) module. There is a similarly named module Webform Multiple File (webform_multiple_file) which is not related to this issue.

Versions affected
Webform Multifile 7.x-1.x versions prior to 7.x-1.4
Drupal core is not affected. If you do not use the contributed Webform Multiple File Upload module, there is nothing you need to do.

Install the latest version:

If you use the Webform Multifile module for Drupal 7.x, upgrade to Webform Multiple File Upload 7.x-1.4
Also see the Webform Multiple File Upload project page.

Reported by
Ben Dougherty of the Drupal Security Team

Fixed by
Jelle Sebreghts the module maintainer
Peter Droogmans the module maintainer

Coordinated by
Ben Dougherty of the Drupal Security Team
Greg Knaddison of the Drupal Security Team

Copyright ©2020 Exploitalert.

All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use.