---
id: "CVE-2020-13671"
kind: "vulnerability"
aliases: ["CVE-2020-13671"]
title: "Drupal Drupal core: Drupal core Un-restricted Upload of File"
severity: "high"
cvss: 8.8
epss: 0.36167
exploited: true
status: "open"
category: "runtime"
products: [{"name": "Drupal Drupal core", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["drupal", "exploited", "runtime", "self-hosted"]
not_affected_if: ["managed-hosting"]
published_at: "2020-11-20T16:15:15+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-13671", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2020-13671", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-13671", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Drupal Drupal core: Drupal core Un-restricted Upload of File

Drupal core does not properly sanitize extension file names during file upload, allowing an unrestricted file upload. An attacker can upload a file with a dangerous extension, which can lead to remote code execution on the Drupal server.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Drupal Drupal core affected ? fixed ?

## Fix

Update Drupal core to a fixed release per the vendor instructions (version not stated in the sources).

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-13671
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2020-13671
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2020-13671

## From the sources

Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP for certain hosting configurations. This issue affects: Drupal Drupal Core 9.0 versions prior to 9.0.8, 8.9 versions prior to 8.9.9, 8.8 versions prior to 8.8.11, and 7 versions prior to 7.74.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_