CVE-2012-2705: The filter_titles function in the Smart Breadcrumb module 6.x-1.x before 6.x-1.3 for Drupal does not proper...

Security readout for executives and security teams

This is a cross-site scripting issue in the Drupal Smart Breadcrumb module. An authenticated user who can create or edit content could place unsafe content in a title field that the module fails to convert to plain text. Business risk is mainly to legacy Drupal 6 sites where trusted content roles are broad or compromised. Exposure is most likely on legacy Drupal 6 sites with Smart Breadcrumb 6.x-1.x installed before 6.x-1.3. Risk depends on whether authenticated users have create or edit node permissions and whether affected breadcrumb output is reachable by administrators or other users. Treat this as a legacy-platform cleanup item with moderate urgency. It is not reported as actively exploited in the provided sources, but it can turn ordinary content permissions into browser-side compromise if old Drupal sites remain exposed. Mitigation focus: Upgrade Smart Breadcrumb to 6.x-1.3 or later where applicable.; Review Drupal advisory guidance before making production changes.; Restrict create and edit node permissions to trusted roles..

Prepared

Jun 24, 2026, 12:34 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.