Packagist/drupal/core: unknown

Drupal 8 core's `file_save_upload()` function does not strip the leading and trailing dot ('.') from filenames, like Drupal 7 did.

Action: Upgrade drupal/core to 8.7.11 or later.

composer require drupal/core:8.7.11

composer require drupal/core:8.8.1

Affected

Fixed versions

Sources

• osv: DRUPAL-CORE-2019-010
• https://www.drupal.org/sa-core-2019-010

published 2019-12-18T18:07:15Z · modified 2026-09-19T19:05:59Z · JSON