Project: 
File Chooser Field
Date: 
2023-May-17
Security risk: 
Moderately critical 14 ∕ 25 AC:Basic/A:User/CI:Some/II:None/E:Exploit/TD:All
Vulnerability: 
Server Side Request Forgery, Information Disclosure
Affected versions: 
<1.13
Description: 

The File Chooser Field allows users to upload files using 3rd party plugins such as Google Drive and Dropbox.

This module fails to validate user input sufficiently which could under certain circumstances lead to a Server Side Request Forgery (SSRF) vulnerability leading to Information Disclosure. In uncommon configurations and scenarios, it might lead to Remote Code Execution.

Solution: 
Reported By: 
Fixed By: 
Coordinated By: