CVE-2015-7234: The OSF module 7.x-3.x before 7.x-3.1 for Drupal, when the OSF Ontology and OSF Import modules are enabled,...

Security readout for executives and security teams

This issue affects some Drupal 7 sites using the OSF module. If OSF 7.x-3.x before 7.x-3.1 is installed and both OSF Ontology and OSF Import are enabled, a user-assisted remote attacker may be able to delete arbitrary files. The public record does not provide CVSS scoring or detailed vectors. Likely exposure is limited to Drupal 7 deployments running the OSF module 7.x-3.x before 7.x-3.1 with OSF Ontology and OSF Import enabled. The supplied affected-product metadata is incomplete, so confirm from Drupal module inventory rather than CPE matching alone. Prioritize remediation for Drupal 7 sites that depend on OSF functionality, especially public-facing or business-critical sites. The lack of scoring and exploit detail lowers certainty, but arbitrary file deletion can still cause outage, data loss, or recovery work. Mitigation focus: Upgrade the Drupal OSF module to 7.x-3.1 or later.; Disable OSF Ontology and OSF Import if they are not required.; Review the linked Drupal advisories for vendor-specific update guidance..

Prepared

Jun 13, 2026, 22:03 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.