{
  "affected": [
    {
      "database_specific": {
        "affected_versions": "\u003c1.6.0"
      },
      "package": {
        "ecosystem": "Packagist:https://packages.drupal.org/8",
        "name": "drupal/svg_formatter"
      },
      "ranges": [
        {
          "database_specific": {
            "constraint": "\u003c1.6.0"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.6.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "severity": []
    }
  ],
  "aliases": [],
  "credits": [
    {
      "contact": [
        "https://www.drupal.org/user/649590"
      ],
      "name": "Balazs Janos Tatar"
    }
  ],
  "details": "This module adds a new formatter for the file fields, which allows any file extension to be uploaded.  \nThe module doesn\u0027t sufficiently handle sanitization under the scenario uploaded SVG files.  \nThis vulnerability is mitigated by the fact that an attacker must have a role with the permission create or edit on certain content types that allows SVG files to be uploaded.",
  "id": "DRUPAL-CONTRIB-2018-027",
  "modified": "2023-08-11T21:40:01.000Z",
  "published": "2018-05-09T20:28:16.000Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://www.drupal.org/sa-contrib-2018-027"
    }
  ],
  "schema_version": "1.7.0"
}