Description
The Xsendfile module enables fast transfer for private files in Drupal.
In order to control private file downloads, the module overrides `ImageStyleDownloadController`, for which a vulnerability was disclosed in [SA-CORE-2023-005](https://www.drupal.org/sa-core-2023-005). The Xsendfile module was still based on an insecure version of `ImageStyleDownloadController`.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | drupal/xsendfile | < 1.2.0 | 1.2.0 | DRUPAL-CONTRIB-2023-053 |