CVE-2012-5653

Name of the Vulnerable Software and Affected Versions Drupal versions 6.x before 6.27 Drupal versions 7.x before 7.18

Description The issue concerns the file upload feature, which allows remote authenticated users to bypass a protection mechanism. This can be achieved by including a null byte in a file name, enabling the execution of arbitrary PHP code.

Recommendations For versions 6.x before 6.27, update to version 6.27 or later. For versions 7.x before 7.18, update to version 7.18 or later.