CVE-2010-1546: Multiple eval injection vulnerabilities in the import functionality in the Chaos Tool Suite (aka CTools) mo...

Security readout for executives and security teams

This flaw affects Drupal sites using older Chaos Tool Suite versions. A user with the page manager administration permission could abuse import text fields to run PHP code on the server. The issue is serious where that permission is broadly assigned, but the supplied evidence does not show active exploitation. Exposure is likely limited to Drupal installations running Chaos Tool Suite 6.x before 6.x-1.4 with the Page Manager component enabled and users assigned administer page manager. The source bundle does not identify other affected products or versions. Prioritize remediation for any externally reachable Drupal site where multiple users can administer Page Manager. This is less urgent where only trusted administrators hold the permission, but arbitrary PHP execution makes confirmed exposure a high-impact finding. Mitigation focus: Upgrade Chaos Tool Suite 6.x to 6.x-1.4 or later.; Review and restrict administer page manager permission assignments.; Remove that privilege from non-essential authenticated users..

Prepared

Jun 28, 2026, 02:49 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.