GHSA-58xv-7h9r-mx3c: 
PHP vulnerability analysis and mitigation

The vulnerability (GHSA-58xv-7h9r-mx3c) was identified in Drupal 8 core, disclosed on December 18, 2019. This moderately critical security issue affects Drupal versions 8.0.0 through 8.7.11 and 8.8.0 through 8.8.1. The vulnerability is related to the file_save_upload() function's handling of filenames with leading and trailing dots (Drupal Advisory).

The vulnerability stems from Drupal 8 core's file_save_upload() function, which failed to strip leading and trailing dots ('.') from filenames, unlike its predecessor in Drupal 7. This technical oversight could potentially allow users with file upload permissions to bypass security protections provided by Drupal's default .htaccess file (GitHub Advisory).

The vulnerability could enable users with file upload permissions to potentially upload system files such as .htaccess, effectively bypassing the security protections that Drupal's default .htaccess file provides. This could lead to unauthorized system file modifications and potential security compromises (Drupal Advisory).

The vulnerability requires an attacker to have user privileges that allow file uploads with any extension, working in conjunction with contributed modules. The exploitation is considered theoretical according to the security risk assessment (Drupal Advisory).

The vulnerability has been patched in Drupal versions 8.7.11 and 8.8.1. The fix implements proper trimming of leading and trailing dots from filenames in the file_save_upload() function. Users are advised to upgrade to these patched versions immediately. Versions of Drupal 8 prior to 8.7.x are end-of-life and do not receive security coverage (Drupal Advisory).