FileField Sources Module for Drupal contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate input passed via filenames before returning it to the user. This may allow a user to create a specially crafted request that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

Upgrade to version 6.x-1.6 or 7.x-1.6 or higher, as they have been reported to fix this vulnerability. In addition, Justin C. Klein Keane has released an unofficial patch for some older versions.

• CVE ID: 2012-5538 (see also: NVD)
• Secunia Advisory ID: 50688
• Bugtraq ID: 55615
• Vendor Specific News/Changelog Entry: http://drupal.org/node/1789300
  http://drupal.org/node/1789302
• Vendor Specific Advisory URL: http://drupal.org/node/1789306
• Other Advisory URL: http://www.madirish.net/539
• Mail List Post: http://www.openwall.com/lists/oss-security/2012/11/20/4

• Justin C. Klein Keane - madirish.net