Intel

AIKIDO-2025-10238

@webiny/api-file-manager is vulnerable to Improper Input Validation

Improper Input Validation Pre-CVE
Found by Aikido Intel before public disclosure or CVE publication.
Published Apr 15, 2025

50

Medium Risk

This Affects:

JS@webiny/api-file-manager
5.0.0 - 5.42.0
Fixed in 5.42.1
Are you affected? Scan for Free

TL;DR

Affected versions of this package are vulnerable to improper input validation, exposing the system to potential threats via uploaded files. To mitigate this, threat detection is introduced for all files uploaded to the File Manager. Uploaded files remain disabled until the threat scan completes; if malicious content is detected, the file is deleted, otherwise it is enabled for user access.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range.

Background info

@webiny/api-file-manager is vulnerable to Improper Input Validation in versions 5.0.0 - 5.42.0.

How to fix this

Upgrade the @webiny/api-file-manager library to the patch version.