CVE-2012-4472

no score yetEPSS 1.4%

Unrestricted file upload vulnerability in upload.php in the Drag & Drop Gallery module 6.x-1.5 and earlier for Drupal allows remote attackers to execute arbitrary PHP code by uploading a file with an executable extension followed by a safe extension, then accessing it via a direct request to the directory specified by the filedir parameter.

EPSS: 1.4% chance of exploitation in the next 30 days; higher than 73% of CVEs (scores of 2026-10-31)
Published: 2012-11-30
Modified: 2026-06-16
Record from: the NVD, synced 2026-10-19

Affected

david_alkire:drag_\&_drop_gallery

References

http://drupal.org/node/1679442
http://secunia.com/advisories/49698
http://www.opensyscom.fr/Actualites/drupal-modules-drag-a-drop-gallery-arbitrary-file-upload-vulnerability.html
http://www.openwall.com/lists/oss-security/2012/10/04/5
http://www.securityfocus.com/bid/54380

Check your stack JSON