VULNERABILITY INTELLIGENCE

CVE-2010-3092

CVSS score5.5 MEDIUM
EPSS probability1.56%
CISA KEVNot currently listed
Published2010-09-21
Last modified2026-06-16
CVSS vectorAV:N/AC:L/Au:S/C:P/I:P/A:N

Description

The upload module in Drupal 5.x before 5.23 and 6.x before 6.18 does not properly support case-insensitive filename handling in a database configuration, which allows remote authenticated users to bypass the intended restrictions on downloading a file by uploading a different file with a similar name.

Primary references