CVE-2007-5596: The core Upload module in Drupal 4.7.x before 4.7.8 and 5.x before 5.3 places the .html extension on a whit...

Security readout for executives and security teams

Older Drupal sites allowed uploaded .html files through the core Upload module. That could let an attacker place scriptable content on the site and trigger cross-site scripting against visitors or administrators. The issue is limited to Drupal 4.7.x before 4.7.8 and 5.x before 5.3 based on the provided CVE text. Exposure is most likely on legacy Drupal 4.7.x or 5.x installations with the core Upload module enabled and user upload workflows available. Modern or upgraded Drupal installations are not identified as affected in the provided sources. Treat this as a legacy web-platform risk. It is not listed as actively exploited in the provided bundle, but affected public-facing Drupal sites could expose users or administrators to XSS. Prioritize remediation if any affected versions remain online. Mitigation focus: Upgrade Drupal 4.7.x systems to 4.7.8 or later.; Upgrade Drupal 5.x systems to 5.3 or later.; Review the Drupal advisory for exact upgrade and operational guidance..

Prepared

Jun 29, 2026, 02:08 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.