CVE-2009-2078: Multiple cross-site scripting (XSS) vulnerabilities in Booktree 5.x before 5.x-7.3 and 6.x before 6.x-1.1,...

Security readout for executives and security teams

CVE-2009-2078 is a cross-site scripting issue in the Drupal Booktree module. A remote attacker could place script or HTML in a tree root page through the node title or body. This can affect site visitors or administrators who view the page, depending on site roles and content controls. Exposure is likely limited to Drupal sites that installed the Booktree module in the affected 5.x or 6.x version ranges. Sites without Booktree, or sites already on 5.x-7.3 or 6.x-1.1 or later, are not indicated as affected by the provided sources. Prioritize remediation for public Drupal sites using affected Booktree versions, especially where untrusted or lower-privileged users can edit relevant content. This is not KEV-listed in the provided bundle, so urgency should be risk-based rather than emergency-driven. Mitigation focus: Upgrade Booktree 5.x to 5.x-7.3 or later.; Upgrade Booktree 6.x to 6.x-1.1 or later.; Check the Drupal advisory pages for any branch-specific guidance..

Prepared

Jun 28, 2026, 10:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.