Media – Critical – 1.x branch unsupported – SA-CONTRIB-2017-042

  • Advisory ID: DRUPAL-SA-CONTRIB-2017-042
  • Project: Media (third-party module)
  • Date: 12-Apr-2017


The Media module provides an extensible framework for managing files and multimedia assets, regardless of whether they are hosted on your own site or a 3rd party site – it is commonly referred to as a ‘file browser to the internet’.

Versions affected

  • Only the 1.x branch is affected. Version 2.0 does not have this vulnerability.

Drupal core is not affected. If you do not use the contributed Media module, there is nothing you need to do.


If you use the Media 1.x branch you should upgrade to version 2.0 or later.

See the Media 2.0 release notes for more information on how to upgrade (it’s more complex than most contrib upgrades – for example, it involves other contrib modules moving from media_entity to file_entity)!

Also see the Media project page.

Reported by

Fixed by

Not applicable

Contact and More Information

The Drupal security team can be reached at security at or via the contact form at

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at

Leave a Reply