Advisory ID: DRUPAL-SA-CONTRIB-2016-038 Project: Webform Multiple File Upload (third-party module) Version: 7.x Date: 2016-July-13 Security risk: 17/25 ( Critical) AC:Basic/A:User/CI:All/II:All/E:Theoretical/TD:Default Vulnerability: Arbitrary PHP code execution Description The Webform Multiple File Upload module allows users to upload multiple files on a Webform. The Webform Multifile File Upload module contains a Remote Code Execution (RCE) vulnerability where form inputs will be unserialized and a specially crafted form input may trigger arbitrary code execution depending on the libraries available on a site. This vulnerability is mitigated by the fact that an attacker must have the ability to submit a Webform with a Multiple File Input field. Further, a site must have an object defined with methods that are invoked at wake/destroy that include code that can be leveraged for malicious purposes. Drupal 7 Core contains one such class which can be used to delete arbitrary files, but contributed or custom classes may include methods that can be leveraged for RCE. Note: this vulnerability exists in the Webform Multiple File Upload (webform_multifile) module. There is a similarly named module Webform Multiple File (webform_multiple_file) which is not related to this issue. Versions affected Webform Multifile 7.x-1.x versions prior to 7.x-1.4 Drupal core is not affected. If you do not use the contributed Webform Multiple File Upload module, there is nothing you need to do. Solution Install the latest version: If you use the Webform Multifile module for Drupal 7.x, upgrade to Webform Multiple File Upload 7.x-1.4 Also see the Webform Multiple File Upload project page. Reported by Ben Dougherty of the Drupal Security Team Fixed by Jelle Sebreghts the module maintainer Peter Droogmans the module maintainer Coordinated by Ben Dougherty of the Drupal Security Team Greg Knaddison of the Drupal Security Team