Vulnerability DRUPAL-CONTRIB-2026-338

This module adds large file, multiple file, and resumable uploads to the File and Image field widgets.

The module doesn't sufficiently check access to resumable upload forms. This allows an unauthenticated user to start uploads against forms they are not permitted to use, and to store partial upload data on the server.

This vulnerability is mitigated by the fact that partial upload data is only attached to content through the normal entity form, which enforces its own access checks, and that stored partial upload data is not executable by the web server.