CVE-2011-0771: The Janrain Engage (formerly RPX) module 6.x-1.3 for Drupal does not validate the file for a profile image,...

Security readout for executives and security teams

This affects Drupal sites using Janrain Engage, formerly RPX, module 6.x-1.3. The module could accept a malicious profile image from an external login provider. An authenticated attacker could use that path for cross-site scripting, and the CVE says arbitrary PHP execution may be possible. Exposure is likely limited to legacy Drupal installations running Janrain Engage/RPX module 6.x-1.3, especially where external login providers import user avatars. Sites not using this module/version are not implicated by the provided sources. Prioritize if any public-facing legacy Drupal site still uses this module. The business risk is account-based web compromise through a third-party login workflow, but urgency is tempered by missing severity data and no cited active exploitation. Mitigation focus: Inventory Drupal sites for Janrain Engage/RPX module 6.x-1.3.; Review Drupal advisory node 1033154 and vendor references for official remediation.; Disable or remove the module if it is unused or unsupported..

Prepared

Jun 28, 2026, 01:17 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.