High severity · published Nov 20, 2020
CVE-2020-13671
Drupal core Un-restricted Upload of File
In wildKEV
8.8
CVSS
36.2%
EPSS
Yes
On KEV
Description
Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP for certain hosting configurations. This issue affects: Drupal Drupal Core 9.0 versions prior to 9.0.8, 8.9 versions prior to 8.9.9, 8.8 versions prior to 8.8.11, and 7 versions prior to 7.74.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)36.2% · higher than 98% of CVEs
Exploited in the wildYes
CISA KEVListed Jan 18, 2022
Federal remediation dueJul 18, 2022
Ransomware campaign useNot known
Affected products
Which versions
DR
Drupal · Drupal
9.0 versions prior to 9.0.8; 8.9 versions prior to 8.9.9; 8.8 versions prior to 8.8.11; 7 versions prior to 7.74 · source: vendor, NVD, KEV
FE
Fedora · Fedoraproject
32; 33 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-13671
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-13671
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
x_refsource_CONFIRM
https://www.drupal.org/sa-core-2020-012
vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KWM4CTMEGAC4I2CHYNJVSROY4CVXVEUT/
vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5KSFM672XW3X6BR7TVKRD63SLZGKK437/
More from Drupal
9.8
CVE-2026-9082
Drupal core - Highly critical - SQL injection - SA-CORE-2026-004
9.8
CVE-2018-7602
Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-004
9.8
CVE-2018-7600
Drupal Core Remote Code Execution Vulnerability
8.1
CVE-2019-6340
Drupal core - Highly critical - Remote Code Execution
7.8
CVE-2020-28949
PEAR Archive_Tar Deserialization of Untrusted Data Vulnerability