← Back to browse · API

CVE-2020-13671

Severity
HIGH
CVSS
8.8
EPSS
0.04304
Risk score
61.71
CISA KEV
Yes
PoC
No
Published
2020-11-20
Modified
2025-10-21
First seen
2026-08-07
Aliases
EUVD-2021-2168, GHSA-68JC-V27H-VHMW
Products
Drupal:Drupal core, Drupal:drupal core 7 versions prior to 7.74, Drupal:drupal core 8.8 versions prior to 8.8.11, Drupal:drupal core 8.9 versions prior to 8.9.9, Drupal:drupal core 9.0 versions prior to 9.0.8
Sources
euvd EUVD-2021-2168
cisa.gov CVE-2020-13671

Description

Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP for certain hosting configurations. This issue affects: Drupal Drupal Core 9.0 versions prior to 9.0.8, 8.9 versions prior to 8.9.9, 8.8 versions prior to 8.8.11, and 7 versions prior to 7.74.

References