{"id":"CVE-2020-13671","kind":"vulnerability","aliases":["CVE-2020-13671"],"related":[],"title":"Drupal Drupal core: Drupal core Un-restricted Upload of File","description":"Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP for certain hosting configurations. This issue affects: Drupal Drupal Core 9.0 versions prior to 9.0.8, 8.9 versions prior to 8.9.9, 8.8 versions prior to 8.8.11, and 7 versions prior to 7.74.","summary":"Drupal core does not properly sanitize extension file names during file upload, allowing an unrestricted file upload. An attacker can upload a file with a dangerous extension, which can lead to remote code execution on the Drupal server.","severity":"high","cvss":8.8,"epss":0.36167,"exploited":true,"exploited_at":"2022-01-18T00:00:00+00:00","products":[{"name":"Drupal Drupal core","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["drupal","exploited","runtime","self-hosted"],"not_affected_if":["managed-hosting"],"how_to_check":null,"fix":"Update Drupal core to a fixed release per the vendor instructions (version not stated in the sources).","status":"open","published_at":"2020-11-20T16:15:15+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:31:35+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-23T21:31:35Z","model":"claude-haiku-5-5","output":{"fix":"Update Drupal core to a fixed release per the vendor instructions (version not stated in the sources).","reach":"internet","impact":"high","summary":"Drupal core does not properly sanitize extension file names during file upload, allowing an unrestricted file upload. An attacker can upload a file with a dangerous extension, which can lead to remote code execution on the Drupal server.","category":"runtime","who_cares":["drupal","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker uploads executable file and runs code on the server","analyst_note":"Confirm affected and fixed Drupal core versions and any exploit conditions from the Drupal security advisory for CVE-2020-13671; CISA KEV lists it as exploited.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000449,"input_tokens":2796,"output_tokens":338,"severity_before":"unknown"},"analyst_status":"queued","analyst_note":"Confirm affected and fixed Drupal core versions and any exploit conditions from the Drupal security advisory for CVE-2020-13671; CISA KEV lists it as exploited.","search":"'-13671':14A,17A '-2020':13A,16A '7':124C '7.74':128C '8.8':118C '8.8.11':122C '8.9':113C '8.9.9':117C '9.0':108C '9.0.8':112C 'affect':104C 'allow':39B 'attack':45B 'certain':71C,99C 'code':59B 'configur':101C 'core':3A,5A,20A,28B,66C,107C 'cve':12A,15A 'danger':52B 'drupal':1A,2A,4A,18A,19A,21B,27B,63B,65C,105C,106C 'execut':60B,95C 'exploit':22B 'extens':33B,53B,86C 'file':11A,34B,37B,42B,49B,75C,80C 'filenam':72C 'host':26B,100C 'incorrect':85C 'interpret':82C 'issu':103C 'lead':56B,78C 'mime':92C 'name':35B 'php':97C 'prior':110C,115C,120C,126C 'proper':31B,69C 'remot':58B 'restrict':8A 'runtim':23B 'sanit':32B,70C 'self':25B 'self-host':24B 'serv':88C 'server':64B 'type':93C 'un':7A 'un-restrict':6A 'unrestrict':41B 'upload':9A,38B,43B,47B,74C 'version':109C,114C,119C,125C 'wrong':91C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2020-11-20T16:15:15+00:00","kev":{"dateAdded":"2022-01-18","dueDate":"2022-07-18","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2020-13671","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-13671","severity":null,"published_at":"2022-01-18T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T14:39:41+00:00","note":null},{"source":"epss","external_id":"CVE-2020-13671","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-13671","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2020-13671","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13671","severity":null,"published_at":"2020-11-20T16:15:15+00:00","modified_at":"2026-06-17T02:53:32+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}