CVE-2007-0505: Drupal Project

High severity, CVSS 8.5. EPSS: 2.8% chance of exploitation in the next 30 days.

Unrestricted file upload vulnerability in the Project issue tracking 4.7.0 through 5.x before 20070123, a module for Drupal, allows remote authenticated users to execute arbitrary code by attaching a file with executable or multiple extensions to a project issue.

Affected products

• Drupal Project: version 4.6 only; version 4.6_1.1 only; version 4.7 only; version 4.7_1.1 only; version 4.7_2.1 only; version 5.0 only
• Drupal Project Issue Tracking Module: version 4.7 only; version 4.7_1.1 only; version 4.7_2.1 only; version 5.0 only

Published 2007-01-26. Last modified 2026-06-16.