{"id":"CVE-2020-13671","published":"2020-11-20T16:15:15Z","modified":"2026-06-17T02:53:32Z","title":"Drupal core Un-restricted Upload of File","vendor":"Drupal","product":"Drupal core","tier":"core","eol":null,"description":{"text":"Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP for certain hosting configurations. This issue affects: Drupal Drupal Core 9.0 versions prior to 9.0.8, 8.9 versions prior to 8.9.9, 8.8 versions prior to 8.8.11, and 7 versions prior to 7.74.","provenance":"source","from":"NVD"},"summary":{"text":"Drupal core fails to properly sanitize certain uploaded filenames, so files can be interpreted under the wrong extension and served with the wrong MIME type or executed as PHP on some hosting configurations. An attacker with low-privileged authenticated access, and no user interaction required, can upload a crafted file over the network to achieve that misinterpretation or execution.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:12:36Z"},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.36167,"percentile":0.98471,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2022-01-18","dueDate":"2022-07-18","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-13671","provenance":"source"},"vulncheckKev":{"dateAdded":"2021-04-12","exploitedFirstSeen":"2021-04-12","ransomware":true,"evidence":[{"url":"https://unit42.paloaltonetworks.com/network-attack-trends-winter-2020/","date":"2021-04-12"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-01-18"},{"url":"https://info.securin.io/hubfs/Securin%20Ransomware%20Report%202023.pdf","date":"2023-02-14"},{"url":"https://www.trustwave.com/hubfs/Web/Library/Documents_pdf/2024_Trustwave_Public_Sector_Threat_Landscape.pdf","date":"2024-05-14"}],"evidenceTotal":4,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-434","name":"Unrestricted Upload of File with Dangerous Type"}],"references":[{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5KSFM672XW3X6BR7TVKRD63SLZGKK437/","tags":["Mailing List","Release Notes"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KWM4CTMEGAC4I2CHYNJVSROY4CVXVEUT/","tags":["Mailing List","Release Notes"]},{"url":"https://www.drupal.org/sa-core-2020-012","tags":["Vendor Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5KSFM672XW3X6BR7TVKRD63SLZGKK437/","tags":["Mailing List","Release Notes"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KWM4CTMEGAC4I2CHYNJVSROY4CVXVEUT/","tags":["Mailing List","Release Notes"]},{"url":"https://www.drupal.org/sa-core-2020-012","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-13671","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Upload of crafted filenames exploits public-facing app","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"Drupal core does not properly sanitize certain filenames on uploaded files","start":0,"end":74}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Uploaded file executed as PHP code","mappingType":"primary_impact","evidence":[{"from":"description","quote":"or executed as PHP for certain hosting configurations","start":179,"end":232}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[{"ecosystem":"Packagist","package":"drupal/core","vulnerableRanges":[">=9.0.0, <9.0.8",">=8.9.0, <8.9.9",">=8.0.0, <8.8.11",">=7.0.0, <7.74"],"patched":["9.0.8","8.9.9","8.8.11","7.74"],"from":["GHSA-68jc-v27h-vhmw","DRUPAL-CORE-2020-012"],"provenance":"source"},{"ecosystem":"Packagist","package":"drupal/drupal","vulnerableRanges":[">=7.0.0, <7.74",">=8.0.0, <8.8.11",">=8.9.0, <8.9.9",">=9.0.0, <9.0.8"],"patched":["7.74","8.8.11","8.9.9","9.0.8"],"from":["GHSA-68jc-v27h-vhmw"],"provenance":"source"}],"advisories":[{"id":"GHSA-68jc-v27h-vhmw","url":"https://github.com/advisories/GHSA-68jc-v27h-vhmw","severity":"HIGH","ecosystem":"Packagist","package":"drupal/core","vulnerableRanges":[">=9.0.0, <9.0.8"],"patched":["9.0.8"],"provenance":"source","from":"GHSA"},{"id":"GHSA-68jc-v27h-vhmw","url":"https://github.com/advisories/GHSA-68jc-v27h-vhmw","severity":"HIGH","ecosystem":"Packagist","package":"drupal/core","vulnerableRanges":[">=8.9.0, <8.9.9"],"patched":["8.9.9"],"provenance":"source","from":"GHSA"},{"id":"GHSA-68jc-v27h-vhmw","url":"https://github.com/advisories/GHSA-68jc-v27h-vhmw","severity":"HIGH","ecosystem":"Packagist","package":"drupal/core","vulnerableRanges":[">=8.0.0, <8.8.11"],"patched":["8.8.11"],"provenance":"source","from":"GHSA"},{"id":"GHSA-68jc-v27h-vhmw","url":"https://github.com/advisories/GHSA-68jc-v27h-vhmw","severity":"HIGH","ecosystem":"Packagist","package":"drupal/core","vulnerableRanges":[">=7.0.0, <7.74"],"patched":["7.74"],"provenance":"source","from":"GHSA"},{"id":"GHSA-68jc-v27h-vhmw","url":"https://github.com/advisories/GHSA-68jc-v27h-vhmw","severity":"HIGH","ecosystem":"Packagist","package":"drupal/drupal","vulnerableRanges":[">=7.0.0, <7.74"],"patched":["7.74"],"provenance":"source","from":"GHSA"},{"id":"GHSA-68jc-v27h-vhmw","url":"https://github.com/advisories/GHSA-68jc-v27h-vhmw","severity":"HIGH","ecosystem":"Packagist","package":"drupal/drupal","vulnerableRanges":[">=8.0.0, <8.8.11"],"patched":["8.8.11"],"provenance":"source","from":"GHSA"},{"id":"GHSA-68jc-v27h-vhmw","url":"https://github.com/advisories/GHSA-68jc-v27h-vhmw","severity":"HIGH","ecosystem":"Packagist","package":"drupal/drupal","vulnerableRanges":[">=8.9.0, <8.9.9"],"patched":["8.9.9"],"provenance":"source","from":"GHSA"},{"id":"GHSA-68jc-v27h-vhmw","url":"https://github.com/advisories/GHSA-68jc-v27h-vhmw","severity":"HIGH","ecosystem":"Packagist","package":"drupal/drupal","vulnerableRanges":[">=9.0.0, <9.0.8"],"patched":["9.0.8"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2021-2168","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-2168","exploited":true,"exploitedSince":"2022-01-18","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":2,"skipped":1,"earliest":"2026-08-22","earliestUrl":"https://github.com/Dungsocool/CVE-2020-13671-old","repos":[{"name":"Dungsocool/CVE-2020-13671-old","url":"https://github.com/Dungsocool/CVE-2020-13671-old","stars":0,"created":"2026-08-22"},{"name":"Dungsocool/CVE-2020-13671","url":"https://github.com/Dungsocool/CVE-2020-13671","stars":0,"created":"2026-08-22"}]},"first":{"date":"2026-08-22","source":"PoC-in-GitHub","url":"https://github.com/Dungsocool/CVE-2020-13671-old"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2020-11-20","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13671","provenance":"source"},{"date":"2021-04-12","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://unit42.paloaltonetworks.com/network-attack-trends-winter-2020/","provenance":"source"},{"date":"2022-01-18","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-01-18","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-2168","provenance":"source"},{"date":"2026-08-22","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/Dungsocool/CVE-2020-13671-old","provenance":"source"}],"speed":{"daysToPublicExploit":2101,"firstExploitFrom":"PoC-in-GitHub","daysToKev":424},"priority":{"score":78.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 2026 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.69,"detail":"percentile 0.9847"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.16,"detail":"base score 8.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"packageHistory":[{"cve":"CVE-2020-13668","published":"2022-02-11","fixed":"9.0.6","kev":false},{"cve":"CVE-2020-13669","published":"2022-02-11","fixed":"9.0.6","kev":false},{"cve":"CVE-2020-13670","published":"2022-02-11","fixed":"9.0.6","kev":false},{"cve":"CVE-2020-13671","published":"2020-11-20","fixed":"9.0.8","kev":true},{"cve":"CVE-2020-13672","published":"2022-02-11","fixed":"9.1.7","kev":false,"link":{"from":"CVE-2020-13671","to":"CVE-2020-13672","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:drupal/drupal","fromFixed":"7.74","toFixed":"7.80","daysApart":448},{"kind":"version-step","provenance":"source","package":"Packagist:drupal/drupal","fromFixed":"8.9.9","toFixed":"8.9.14","daysApart":448}]}},{"cve":"CVE-2021-33829","published":"2021-06-09","fixed":"9.1.9","kev":false,"link":{"from":"CVE-2020-13671","to":"CVE-2021-33829","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:drupal/drupal","fromFixed":"7.74","toFixed":"7.80","daysApart":201},{"kind":"version-step","provenance":"source","package":"Packagist:drupal/core","fromFixed":"7.74","toFixed":"7.80","daysApart":201}]}},{"cve":"CVE-2024-55638","published":"2024-12-09","fixed":"10.3.9","kev":false}],"package":"Packagist:drupal/drupal"}}