The BlogAPI module did not validate the extension of uploaded files, enabled users with the “administer content with blog api” permission to upload harmful files.
Part of security release SA-2008-047
This vulnerability affects the following application versions:
- Drupal 6.0
- Drupal 6.1
- Drupal 6.2
- Drupal 6.3