File and Path Handling

Every one of the 6 is a mark on the map. Named now: 1 to 6, most at risk first.

1. Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type…CVE-2020-13671Drupal · CVSS 8.8 · 33% likely

   CWE-434

2. Files uploaded by anonymous users into a private file system can be accessed by other anonymous usersCVE-2017-6922Drupal · 1.9% likely

   CWE-552

3. Drupal core sanitizes filenames with dangerous extensions upon upload (reference: SA-CORE-2020-012) and strips leading and trailing dots from filenames to prevent uploading server…CVE-2022-25277Drupal · CVSS 7.2 · 1.4% likely

   CWE-434

4. Single Content Sync - Critical - External control of file name or path - SA-CONTRIB-2026-274CVE-2026-118561Drupal · CVSS 7.2 · 0.3% likely

   CWE-73

5. Screenshot - Critical - Unsupported - SA-CONTRIB-2026-102CVE-2026-76782Drupal · CVSS 7.3 · 0.3% likely

   CWE-434

6. Media Library Importer - Moderately critical - Access bypass - SA-CONTRIB-2026-129CVE-2026-81163Drupal · CVSS 5.4 · 0.3% likely

   CWE-22

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.