CVE-2020-13671Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP f…
Updated under an hour ago ()
Does this affect you?
It affects Drupal Core and 2 other products. Add what you run to find out whether that includes you.
CISA lists it as known exploited since Jan 18, 2022; federal agencies had to remediate by Jul 18, 2022. Treat that date as your deadline.
Do this next
Free account, 1 product
Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP for certain hosting configurations. This issue affects: Drupal Drupal Core 9.0 versions prior to 9.0.8, 8.9 versions prior to 8.9.9, 8.8 versions prior to 8.8.11, and 7 versions prior to 7.74.
- CVSS
- 8.8 HIGH (v3.1, CISA ADP)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- CWE-434
- Known exploited
- Added to CISA KEV Jan 18, 2022; federal remediation due Jul 18, 2022Apply updates per vendor instructions.
- EPSS (exploitation in the next 30 days)
- 36.17% (percentile 98)
- Assigned by
- drupal
- NVD analysis
- Analyzed
- Record last updated
- Oct 21, 2025
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Drupal Drupal Core drupal:core (from the name) | 9.0 versions prior to 9.0.8; 8.9 versions prior to 8.9.9; 8.8 versions prior to 8.8.11; 7 versions prior to 7.74 | CNA record |
drupal drupal drupal:drupal | from 7.0 before 7.74; from 8.8.0 before 8.8.11; from 8.9.0 before 8.9.9; from 9.0.0 before 9.0.8 | NVD |
fedoraproject fedora fedoraproject:fedora | 32; 33 | NVD |
References
- https://www.drupal.org/sa-core-2020-012x-refsource-confirm, vendor-advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KWM4CTMEGAC4I2CHYNJVSROY4CVXVEUT/vendor-advisory, x-refsource-fedora, mailing-list, release-notes
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5KSFM672XW3X6BR7TVKRD63SLZGKK437/vendor-advisory, x-refsource-fedora, mailing-list, release-notes
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-13671us-government-resource
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.