CVE-2020-13671 Drupal core Un-restricted Upload of File

What is CVE-2020-13671?

CVE-2020-13671 is a high-severity vulnerability in Drupal Drupal, published on 20 Nov 2020. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP for certain hosting configurations. This issue affects: Drupal Drupal Core 9.0 versions prior to 9.0.8, 8.9 versions prior to 8.9.9, 8.8 versions prior to 8.8.11, and 7 versions prior to 7.74.

Weakness: CWE-434

Which versions are affected by CVE-2020-13671?

18 open source packages ship an affected version, including drupal/core, drupal and drupal/drupal. It affects 2 products.

Products include Drupal Drupal, Fedoraproject Fedora.

How do I fix CVE-2020-13671?

Upgrade drupal/core to a fixed version for your release line: 7.74, 8.8.11, 8.9.9 or 9.0.8. US federal agencies must fix it by 18 Jul 2022.

Is CVE-2020-13671 being exploited?

Yes. Attackers have exploited CVE-2020-13671 in the wild since at least 18 Jan 2022.

Public exploit code: 3 proofs of concept on GitHub.

Other vulnerabilities in Drupal Drupal

• CVE-2026-9082 Drupal Core SQL Injection Exploited Critical 9.8
• CVE-2019-6340 Drupal Core Remote Code Execution Exploited High 8.1
• CVE-2009-3352 Other in n/a Critical 10.0
• CVE-2024-55636 Drupal core - Less critical - Gadget chain - SA-CORE-2024-006 Critical 9.8
• CVE-2024-55637 Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-007 Critical 9.8

All Drupal Drupal vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-drupal-2020-13671, DRUPAL-CORE-2020-012, GHSA-68jc-v27h-vhmw, UBUNTU-CVE-2020-13671.