CVE-2008-4147: Cross-site scripting (XSS) vulnerability in the Mailsave module 5.x before 5.x-3.3 and 6.x before 6.x-1.3,...

Security readout for executives and security teams

CVE-2008-4147 affects the Drupal Mailsave module. An attacker could send an email with an attachment using a manipulated Content-Type value, causing script or HTML to be injected when processed or viewed. This is mainly a risk for Drupal sites that still use vulnerable Mailsave versions. Exposure is likely limited to Drupal deployments using the Mailsave module in the vulnerable 5.x or 6.x ranges. Sites not using Mailsave, or using fixed versions, are not indicated as affected by the provided sources. Prioritize if legacy Drupal sites still process inbound email through Mailsave. The business risk is session theft or content manipulation through XSS, but urgency depends on whether the vulnerable module is present and reachable. Mitigation focus: Upgrade Mailsave 5.x to 5.x-3.3 or later, if applicable.; Upgrade Mailsave 6.x to 6.x-1.3 or later, if applicable.; If Mailsave is unnecessary, remove or disable it through normal change control..

Prepared

Jun 28, 2026, 18:33 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.