Executive brief
The Combined Image Style module for Drupal allows website administrators to process and combine multiple image formats into single optimized files. A flaw in how the module validates image style names allows anonymous users to generate image files without proper authorization tokens, potentially causing denial of service through excessive resource consumption. The vulnerability affects only publicly accessible files, as private files retain protection from Drupal core's token validation.
Technical details
The module fails to properly validate image style names during derivative generation, enabling bypassing of token-based access control. Anonymous users can exploit this to trigger image generation operations without authorization, affecting public files. The vulnerability is mitigated by design: only public files are vulnerable, private files are protected by Drupal core's token checks, and derivatives can be generated only through the module's request paths.
Affected products
- Drupal Combined Image Style before 1.0.7
Timeline
- 2026-09-23: disclosed