CVE-2007-5595: CRLF injection vulnerability in the drupal_goto function in includes/common.inc Drupal 4.7.x before 4.7.8 a...

Security readout for executives and security teams

This is an old Drupal flaw in redirect handling. A remote attacker could inject extra HTTP headers into a response, enabling HTTP response splitting. That can support cache poisoning, content manipulation, or phishing-style impacts depending on site behavior. The evidence only names Drupal 4.7.x before 4.7.8 and Drupal 5.x before 5.3. Exposure is most likely limited to legacy Drupal 4.7.x or 5.x installations, especially unmaintained public sites. Modern Drupal branches are not identified as affected in the supplied sources. Asset inventories should treat any unknown legacy Drupal instance as needing version confirmation. Prioritize based on whether legacy Drupal still exists. For active internet-facing Drupal 4.x or 5.x, treat remediation as time-sensitive because the flaw is remotely reachable and affects HTTP responses. If no such legacy systems exist, record the finding as not applicable. Mitigation focus: Upgrade Drupal 4.7.x to at least 4.7.8 or later supported software.; Upgrade Drupal 5.x to at least 5.3 or later supported software.; Retire unsupported Drupal 4.x and 5.x public deployments where possible..

Prepared

Jun 29, 2026, 02:08 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.