Primary links
- Advisory ID: DRUPAL-SA-2008-067
- Project: Drupal core
- Version: 5.x, 6.x
- Date: 2008-October-22
- Security risk: Less Critical
- Exploitable from: Remote
- Vulnerability: File inclusion
On a server configured for IP-based virtual hosts, Drupal may be caused to include and execute specifically named files outside of its root directory.
The official announcement for Drupal 5.x is here.
Considerations for Drupal 4.7
Drupal 4.7 is vulnerable to the same attack and should be patched. The affected function in includes/bootstrap.inc did not change between version 4.7 and 5.x.
