CVE-2008-6171: Drupal

High severity, CVSS 9.3. EPSS: 3.7% chance of exploitation in the next 30 days.

includes/bootstrap.inc in Drupal 5.x before 5.12 and 6.x before 6.6, when the server is configured for "IP-based virtual hosts," allows remote attackers to include and execute arbitrary files via the HTTP Host header.

Affected products

• Drupal Drupal: version 5.0 only; version 5.1 only; version 5.2 only; version 5.3 only; version 5.4 only; version 5.5 only; …

Published 2009-02-19. Last modified 2026-06-16.