Drupal Opigno Module PHP Local File Inclusion Vulnerability

A static code injection vulnerability allowing PHP local file inclusion has been identified in the Drupal Opigno module, affecting versions prior to 3.1.2. This issue arises from improper validation of uploaded files, which could lead to arbitrary file uploads and potentially allow remote code execution. The vulnerability requires the attacker to have a role with permission to create Opigno TinCan activities.

Impact

Exploitation of this vulnerability could lead to arbitrary PHP code execution on the server.

Remediation

Users of the Opigno module should upgrade to version 3.1.2 or later.