Description
Drupal 4.6.x before 4.6.8 and 4.7.x before 4.7.2, when running under certain Apache configurations such as when FileInfo overrides are disabled within .htaccess, allows remote attackers to execute arbitrary code by uploading a file with multiple extensions, a variant of CVE-2006-2743.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.1 | drupal | 4.5.3-6.1sarge1 | DSA-1125 |
Advisories 1
- DSA-1125 drupal - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- 18245 vdb-entry
- 20060602 [DRUPAL-SA-2006-007] Drupal 4.6.8 / 4.7.2 fixes arbitrary file execution issue mailing-list
- DSA-1125 vendor-advisory
- 21244 third-party-advisory
- http://drupal.org/node/66763
- 1042 third-party-advisory
- http://drupal.org/files/sa-2006-007/advisory.txt