CVE-2020-13671

Description

Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP for certain hosting configurations. This issue affects: Drupal Drupal Core 9.0 versions prior to 9.0.8, 8.9 versions prior to 8.9.9, 8.8 versions prior to 8.8.11, and 7 versions prior to 7.74.

How to fix CVE-2020-13671

To remediate CVE-2020-13671, upgrade the affected package to a fixed version below.

• —upgrade to 7.74.0 or later
• —upgrade to 8.8.11 or later
• —upgrade to 9.0.8 or later
• —upgrade to 7.74 or later

Is CVE-2020-13671 being exploited?

Yes — CVE-2020-13671 is on the CISA Known Exploited Vulnerabilities (KEV) catalog. Patch immediately.

Affected packages (4)

• >= 7.0.0, < 7.74.0, >= 8.8.0, < 8.8.11, >= 8.9.0, < 8.9.9, >= 9.0.0, < 9.0.8
• >= 8.0.0, < 8.8.11 | >= 8.9.0, < 8.9.9 | >= 9.0.0, < 9.0.8
• >= 9.0.0, < 9.0.8
• >= 7.0.0, < 7.74

CVSS scores

References (12)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2020-13671
• PATCHgithub.com/drupal/core
• WEBgithub.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2020-13671.yaml
• WEBgithub.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2020-13671.yaml