CVE-2007-1035

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2007-02-21 · updated 2026-06-16

Description

Unspecified vulnerability in certain demonstration scripts in getID3 1.7.1, as used in the Mediafield and Audio modules for Drupal, allows remote attackers to read and delete arbitrary files, list arbitrary directories, and write to empty files or .mp3 files via unknown vectors.

Affected products

Drupal Audio Module: all versions
Drupal Getid3: 1.7.1
Drupal Mediafield Module: all versions

References

http://blamcast.net/articles/highly-critical-security-flaws-in-drupal-audio-module
http://drupal.org/node/119385
http://osvdb.org/35161
http://www.securityfocus.com/bid/22587
http://www.vupen.com/english/advisories/2007/0635
https://exchange.xforce.ibmcloud.com/vulnerabilities/32542
http://blamcast.net/articles/highly-critical-security-flaws-in-drupal-audio-module
http://drupal.org/node/119385
http://osvdb.org/35161
http://www.securityfocus.com/bid/22587
http://www.vupen.com/english/advisories/2007/0635
https://exchange.xforce.ibmcloud.com/vulnerabilities/32542

Get alerted when CVE-2007-1035 or the next vulnerability affects your stack