Issue #1870612 by greggles, aasarava, quicksketch, Justin_KleinKeane, John Morahan: SA-CORE-2012-004 - Drupal core - Arbitrary code execution via file upload.