CVE-2006-2743: Drupal

Medium severity, CVSS 5.1. EPSS: 11.1% chance of exploitation in the next 30 days.

Drupal 4.6.x before 4.6.7 and 4.7.0, when running on Apache with mod_mime, does not properly handle files with multiple extensions, which allows remote attackers to upload, modify, or execute arbitrary files in the files directory.

Affected products

• Drupal Drupal: version 4.6 only; version 4.6.0 only; version 4.6.1 only; version 4.6.2 only; version 4.6.3 only; version 4.6.4 only; …

Published 2006-06-01. Last modified 2026-06-16.