{"action":"Upgrade drupal/core to 8.5.14 or later.","affected":[{"fixed":"8.5.14","introduced":"8.0.0"},{"fixed":"8.6.13","introduced":"8.6.0"}],"component":"drupal/core","cve_ids":["CVE-2019-6341"],"ecosystem":"Packagist","epss":0.12187,"exploited":false,"fixed_versions":["8.5.14","8.6.13"],"ghsa_id":"GHSA-cmmh-8mwp-gq5p","id":"tcs_01M5KER7BRZFM399S3SMSS07CC","modified_at":"2026-09-19T19:56:42Z","published_at":"2019-03-20T16:08:16Z","references":["https://osv.dev/vulnerability/DRUPAL-CORE-2019-004","https://www.drupal.org/sa-core-2019-004"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"DRUPAL-CORE-2019-004","url":"https://osv.dev/vulnerability/DRUPAL-CORE-2019-004"}],"summary":"Under certain circumstances the File module/subsystem allows a malicious user to upload a file that can trigger a cross-site scripting (XSS) vulnerability."}