dbcve.org
KcfinderDrupal extension · Sunhater

CVE-2018-25002

HIGH · 8.8 CVSS v3.1 Published 2021-01-01
Fix available
A fix is available. Upgrade to after 2018-06-01 or later.
See remediation →
94/100
Remediation priority · Urgent
Remotely reachable Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
uploader.php in the KCFinder integration project through 2018-06-01 for Drupal mishandles validation, aka SA-CONTRIB-2018-024. NOTE: This project is not covered by Drupal's security advisory policy.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · moderate confidence

The uploader.php file in the KCFinder integration module for Drupal contains a validation flaw (SA-CONTRIB-2018-024) that allows the upload functionality to improperly handle validation checks. This likely enables unauthorized or malicious file uploads due to insufficient input validation in the file upload process.

MitigationUpdate to the patched version of KCFinder integration for Drupal that addresses the validation issue in uploader.php, or disable the module until a fix is available. Implement strict server-side file type and content validation for all uploaded files.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
KcfinderDrupal extension
Affected:<= 2018-06-01

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Locate the KCFinder module in your Drupal installation
    Search for the 'kcfinder' directory or module in your Drupal webroot, typically under modules/contrib/ or sites/all/modules/. Use command: find /path/to/drupal -type d -iname '*kcfinder*' 2>/dev/null
    Affected if The KCFinder directory or module files exist in your Drupal installation
  2. Identify the KCFinder version
    Check the uploader.php file modification date or look for a version file. Use: ls -la /path/to/drupal/modules/.../kcfinder/uploader.php or check for a version.php file in the module root
    Affected if The uploader.php file exists and was last modified on or before June 1, 2018, indicating an unpatched version
  3. Verify the upload functionality is enabled
    Check if the KCFinder module is enabled in Drupal. Run: drush pm-list --status=enabled | grep -i kcfinder or check your Drupal modules directory for enabled status
    Affected if The KCFinder module is enabled and active in your Drupal installation
  4. Inspect uploader.php for the validation flaw
    Examine the uploader.php file for missing or weak file type validation. Look for: absence of proper mime-type checking, missing extension validation, or disabled file upload restrictions. Use: cat /path/to/kcfinder/uploader.php | grep -i 'type\|extension\|validation'
    Affected if The uploader.php contains insufficient server-side validation checks for file uploads (missing or weak type/extension validation)
  5. Check Drupal's file upload configuration
    Review Drupal's admin configuration for file uploads: admin/config/media/file-system. Verify if KCFinder is configured as a CKEditor plugin or file browser, as this exposes the vulnerable upload functionality
    Affected if KCFinder is integrated with CKEditor or enabled as a file browser, making the upload functionality publicly accessible

You are affected if KCFinder module is installed and enabled with an unpatched uploader.php file dated on or before June 2018, and the file upload functionality is exposed through Drupal.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

From vendor data
Upgrade available Upgrade to a release after 2018-06-01
Interim mitigation

Update to the patched version of KCFinder integration for Drupal that addresses the validation issue in uploader.php, or disable the module until a fix is available. Implement strict server-side file type and content validation for all uploaded files.

Fix this in Kcfinder Scoped from the published advisory
  • Consultation2.0 h
  • Implementation3.0 h
  • Testing3.0 h
  • Review / QA2.0 h
10.0 hours of engineering $1,750
Get the upgrade done

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $2,800.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2018-25002 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2018-25002 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data