CVE-2008-3001: Drupal Aggregation Module

High severity, CVSS 9.3. EPSS: 3.4% chance of exploitation in the next 30 days.

The Aggregation module 5.x before 5.x-4.4 for Drupal allows remote attackers to upload files with arbitrary extensions, and possibly execute arbitrary code, via a crafted feed that allows upload of files with arbitrary extensions.

Affected products

• Drupal Aggregation Module: version 3.0 only; version 3.1 only; version 3.2 only; version 4.0 only; version 4.1 only; version 4.2 only; …

Published 2008-07-03. Last modified 2026-06-16.