Drupal security advisory DRUPAL-SA-2006-007: Recently, the Drupal security team was informed of a potential exploit that would allow untrusted code to be executed upon a successful request by a malicious user. If a dynamic script with multiple extensions such as file.php.pps or file.sh.txt is uploaded and then accessed from a web browser under certain common Apache configurations, it will cause the script inside to be executed. We deemed this exploit critical and released Drupal 4.6.7 and 4.7.1 six hours after the report was filed. The fix was to create a .htaccess file to remove all dynamic script handlers, such as PHP, from the “files” directory.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/46981/DRUPAL-SA-2006-007.txt
Source: https://packetstormsecurity.com/files/46981/DRUPAL-SA-2006-007.txt.html