CVE-2006-2743

None

CVSS

—

EPSS

11.1%

Published

Jun 1, 2006

CISA due date

—

The record

Drupal 4.6.x before 4.6.7 and 4.7.0, when running on Apache with mod_mime, does not properly handle files with multiple extensions, which allows remote attackers to upload, modify, or execute arbitrary files in the files directory.

Affected packages

Ecosystem	Package	Introduced	Fixed
Debian:3.1	drupal	0	4.5.3-6.1sarge1

Related vulnerabilities

CVE-2005-1921 Eval injection vulnerability in PEAR XML_RPC 1.3.0 and earlier (aka XML-RPC or xmlrpc)… Also affects drupal