The Drupal Media module version 7.x-2.x contains a remote code execution vulnerability which was patched with:


1.x and 2.x seem to be very different beasts, I can't find any corresponding code to media_ajax_upload() in 1.x but I'm still rather unsure wether this version is vulnerable or not.

  • 1
    Someone has ask the question in the module issues drupal.org/project/media/issues/2966112 But the version 7.x-1.x seems no longer support, so, it could be possible but I think mainteners will not patch the version now.
    – Claire D
    Apr 25, 2018 at 21:04

1 Answer 1


According to Joseph Olstad 1.x is not vulnerable to the problem found in the 2.x branch. Source: https://www.drupal.org/project/media/issues/2966112#comment-12592407

There is a previously unreleased fix for another security issue though. This was integrated in version 1.7 of this module.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.