Description
Drupal 6.x before 6.27 allows remote attackers to obtain sensitive information about uploaded files via a (1) RSS feed or (2) search result.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 6.0 | drupal6 | 6.28-1 | DSA-2776-1 |
Advisories 1
- DSA-2776-1 drupal6 - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://drupalcode.org/project/drupal.git/commitdiff/da8023a
- http://drupal.org/SA-CORE-2012-004
- 56993 vdb-entry
- 88527 vdb-entry
- DSA-2776 vendor-advisory
- drupal-upload-information-disclosure(80794) vdb-entry
- [oss-security] 20121219 Re: CVE request for Drupal core, and contributed modules mailing-list
- 51517 third-party-advisory