This module enables you to combine multiple image styles into a single image derivative. The module does not sufficiently validate image style names when gener...

The module does not sufficiently validate image style names when generating image derivatives. Under certain circumstances, anonymous users can generate derivatives without a valid token, potentially causing a denial of service. Sites are affected simply by having the module installed, even if no combined image styles are configured or used. Only public files can be targeted; derivatives of private files remain protected by core's token check.

Look for drupal/combined_image_style and its installed version in composer.lock. The advisory lists 1.0.7 as fixed but gives no affected version range. Having the module installed is enough for exposure, so do not rule your site out because combined image styles are unused or unconfigured.

Only public files can be targeted. Derivatives of private files remain protected by core's token check.

This module enables you to combine multiple image styles into a single image derivative.

The module does not sufficiently validate image style names when generating image derivatives. Under certain circumstances, this allows anonymous users to generate image derivatives without a valid token, potentially leading to a denial of service.

Sites are affected simply by having the module installed, even when no combined image styles are configured or in use.

This vulnerability is mitigated by the fact that only public files can be targeted, and derivatives of private files are still protected by core's token check.