CVE-2019-6341

In Drupal 7 versions prior to 7.65; Drupal 8.6 versions prior to 8.6.13;Drupal 8.5 versions prior to 8.5.14. Under certain circumstances the File module/subsystem allows a malicious user to upload a file that can trigger a cross-site scripting (XSS) vulnerability.

• CWE-79

• https://lists.debian.org/debian-lts-announce/2019/04/msg00003.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IWHF4LALNBZCXMITWWVWKY3PNVYTM3N7/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P4KTET2PTSIS3ZZ4SGBRQEN6CCLV5SYX/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QNTLCBAN6T7WYR5C4TNEYQD65IIR3V4P/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y4SVTVIJ33XCFQ6X6XTVMQM3NPLP2WFS/
• https://www.drupal.org/sa-core-2019-004Patch, Vendor Advisory
• https://www.synology.com/security/advisory/Synology_SA_19_13
• https://lists.debian.org/debian-lts-announce/2019/04/msg00003.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IWHF4LALNBZCXMITWWVWKY3PNVYTM3N7/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P4KTET2PTSIS3ZZ4SGBRQEN6CCLV5SYX/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QNTLCBAN6T7WYR5C4TNEYQD65IIR3V4P/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y4SVTVIJ33XCFQ6X6XTVMQM3NPLP2WFS/
• https://www.drupal.org/sa-core-2019-004Patch, Vendor Advisory
• https://www.synology.com/security/advisory/Synology_SA_19_13

Published

Mar 26, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-6334HP LaserJet, PageWide, OfficeJet Enterprise, and LaserJet Ma…9.8
• CVE-2019-6335A potential security vulnerability has been identified with …7.5
• CVE-2019-6337For the printers listed a maliciously crafted print file mig…5.2
• CVE-2019-6338In Drupal Core versions 7.x prior to 7.62, 8.6.x prior to 8.…
• CVE-2019-6339In Drupal Core versions 7.x prior to 7.62, 8.6.x prior to 8.…
• CVE-2019-6340Some field types do not properly sanitize data from non-form…8.1
• CVE-2019-6342An access bypass vulnerability exists when the experimental …9.8
• CVE-2019-6438SchedMD Slurm before 17.11.13 and 18.x before 18.08.5 mishan…
• CVE-2019-6439examples/benchmark/tls_bench.c in a benchmark tool in wolfSS…
• CVE-2019-6440Zemana AntiMalware before 3.0.658 Beta mishandles update log…
• CVE-2019-6441An issue was discovered on Shenzhen Coship RT3050 4.0.0.40, …
• CVE-2019-6442An issue was discovered in NTPsec before 1.1.3. An authentic…