- Package
- drupal/media_alias_display
- Fixed in
- 2.1.3, 3.0.3
- Published
- Wed 28 Oct 2026, 17:50 LisbonUpdated Mon 2 Nov 2026, 07:26 Lisbon
In plain words
Media Alias Display can serve files with Cache-Control: public when they should not be cached, allowing users to receive cached files containing information they should not be able to access. This requires Drupal to handle non-public files through a custom or contributed module providing an additional file scheme. An attacker must know to request a file previously requested by a more-privileged user, and the file must still be cached. This advisory follows an earlier fix that did not fully resolve the vulnerability.
Am I affected?
Find drupal/media_alias_display and its version in composer.lock. The advisory lists fixes in 2.1.3 and 3.0.3 but gives no affected version range. Check whether Drupal uses a custom or contributed module providing an additional file scheme for non-public files, and whether those files can be served with Cache-Control: public and remain cached after a more-privileged user's request.
What to do
Check which version you have, then update to a fixed release for your branch (2.1.3, 3.0.3):
composer show drupal/media_alias_display | grep versions
composer update drupal/media_alias_displayIf your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.
If you cannot update yet
The advisory lists limiting conditions: Drupal must use a custom or contributed module providing an additional file scheme for non-public files, and an attacker must know to request a file previously requested by a more-privileged user while it is still cached.
The advisory's description
This module allows for direct viewing of a file with the URL alias.
This is a followup advisory to SA-CONTRIB-2026-245, which did not fully resolve the underlying vulnerability.
In some cases, files may be served with the HTTP header Cache-Control: public when they should be uncacheable. This can lead to some users getting cached versions of files with information they should not be able to access.
This vulnerability is mitigated by the following:
- Drupal must be configured to handle non-public files using a custom or contributed module providing an additional file scheme.
- An attacker must know to request a file that has previously been requested by a more-privileged user, and that file must still be cached.