Description
includes/bootstrap.inc in Drupal 5.x before 5.12 and 6.x before 6.6, when the server is configured for "IP-based virtual hosts," allows remote attackers to include and execute arbitrary files via the HTTP Host header.
Remediation
References
Related Vulnerabilities
Joomla! Core 3.x.x Local File Inclusion (3.0.0 - 3.9.25)
WordPress 4.2.2 Multiple Vulnerabilities (0.7 - 4.2.2)
WordPress 5.0.x Multiple Vulnerabilities (5.0 - 5.0.14)
Liferay DXP Authorization Bypass Through User-Controlled Key Vulnerability (CVE-2025-62252)
WordPress Plugin Search Everything Cross-Site Request Forgery (8.1)