Live › vulnerability › CVE-2020-13671
Go to dashboardDrupal core does not properly sanitize extension file names during file upload, allowing an unrestricted file upload. An attacker can upload a file with a dangerous extension, which can lead to remote code execution on the Drupal server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Drupal Drupal core | vendor | – | – |
Unknown from the sources. In the analyst’s queue.
Update Drupal core to a fixed release per the vendor instructions (version not stated in the sources).
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP for certain hosting configurations. This issue affects: Drupal Drupal Core 9.0 versions prior to 9.0.8, 8.9 versions prior to 8.9.9, 8.8 versions prior to 8.8.11, and 7 versions prior to 7.74.
This page as .md · .json · in your agent: get_signal("CVE-2020-13671")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.