Drupal · Drupal core
CVE-2020-13671
Drupal core Un-restricted Upload of File
What it is
Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP for certain hosting configurations. This issue affects: Drupal Drupal Core 9.0 versions prior to 9.0.8, 8.9 versions prior to 8.9.9, 8.8 versions prior to 8.8.11, and 7 versions prior to 7.74.
CISA: Improper sanitization in the extension file names is present in Drupal core.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: July 18, 2022
More exploited flaws from Drupal
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Nov 3, 2021 | Core Remote Code Execution | Drupal Core | Critical 9.8 | >99.9% |
| May 22, 2026 | SQL Injection | Core | Critical 9.8 | 89% |
| Apr 13, 2022 | Remote Code Execution | Core | High 8.1 | 99.2% |
| Mar 25, 2022 | Remote Code Execution | Core | High 8.1 | 92% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.