Description
The private filesystem in Drupal 5.x before 5.10 and 6.x before 6.4 trusts the MIME type sent by a web browser, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks by uploading files containing arbitrary web script or HTML.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | drupal5 | 5.9-1.1+lenny1 | DTSA-156-1 |
Advisories 1
- DTSA-156-1 drupal5 - multiple vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- https://bugzilla.redhat.com/show_bug.cgi?id=459108
- 30689 vdb-entry
- 31825 third-party-advisory
- ADV-2008-2392 vdb-entry
- FEDORA-2008-7626 vendor-advisory
- drupal-mimemedia-xss(44446) vdb-entry
- http://drupal.org/node/295053
- FEDORA-2008-7467 vendor-advisory
- 31462 third-party-advisory