Description
The file upload feature in Drupal 6.x before 6.27 and 7.x before 7.18 allows remote authenticated users to bypass the protection mechanism and execute arbitrary PHP code via a null byte in a file name.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 6.0 | drupal6 | 6.28-1 | DSA-2776-1 |
Advisories 1
- DSA-2776-1 drupal6 - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- 88529 vdb-entry
- http://drupalcode.org/project/drupal.git/commitdiff/da8023a
- MDVSA-2013:074 vendor-advisory
- http://drupal.org/SA-CORE-2012-004
- 56993 vdb-entry
- http://drupalcode.org/project/drupal.git/commitdiff/b47f95d
- DSA-2776 vendor-advisory
- [oss-security] 20121219 Re: CVE request for Drupal core, and contributed modules mailing-list
- drupal-fileupload-code-execution(80795) vdb-entry