CVE-2020-13671: Drupal core filename sanitization flaw allows uploaded files to execute as PHP

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw allows remote code execution via file upload, is listed in CISA KEV as exploited, and carries a high EPSS score, though it requires a low-privileged authenticated account.

What it is

Drupal core fails to properly sanitize certain filenames on uploaded files, so files can be interpreted with the wrong extension and served as the wrong MIME type or executed as PHP under certain hosting configurations. It affects Drupal Core 9.0 before 9.0.8, 8.9 before 8.9.9, 8.8 before 8.8.11, and 7 before 7.74. Because it enables code execution on the server, it is a serious risk for any unpatched Drupal site that permits file uploads.

Impact

An attacker with the ability to upload files can place a file that the server executes as PHP, gaining code execution in the web server context. That can lead to full compromise of the Drupal site and its data.

Attack surface

The flaw is reached over the network through Drupal's file upload functionality, as reflected by the CVSS vector AV:N/PR:L/UI:N. It requires a low-privileged authenticated account able to upload files; no user interaction is needed.

Exploitation

CVE-2020-13671 is listed in CISA KEV with a due date of 2022-07-18, indicating known exploitation, and EPSS shows a 30-day probability of 0.3535 (98.4th percentile). No ransomware campaign use is documented.

What to do

• Upgrade Drupal core to 9.0.8, 8.9.9, 8.8.11, or 7.74 (or later) as directed by the vendor advisory sa-core-2020-012.
• Apply the corresponding Fedora package updates referenced in the Fedora package-announce mailing lists.
• Restrict file upload permissions to only trusted roles and review which roles can upload files.
• Harden the web server so uploaded files cannot be executed as PHP (for example, disable script execution in upload directories).

Detection

• Monitor upload directories for newly written files with executable extensions or mismatched MIME types.
• Alert on web server or PHP logs showing execution of files from user upload paths.
• Audit Drupal file entities and recent uploads for suspicious filenames or extensions.
• Track Drupal core versions across the estate to find hosts still below the fixed releases.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.