Skip to content
OpenAdvisories
High 1 exploited CVE DLA-2458-1 2 CVEs

drupal7 - security update

Published Nov 19, 2020 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 9 drupal7 7.52-2+deb9u12

Vulnerabilities 2

  • High 8.8
    CVE-2020-13671 Exploited Public exploit EPSS 31%

    Drupal core Unrestricted Upload of File with Dangerous Type

    Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP for certain hosting configurations. This issue affects: Drupa…

    Drupal Drupal core drupal/core drupal/drupal Web / CMS Ubuntu Alpine Packagist
    KEV Jan 18, 2022
  • Medium 6.1
    CVE-2020-13666

    Drupal Core Cross-site scripting vulnerability

    Cross-site scripting vulnerability in Drupal Core. Drupal AJAX API does not disable JSONP by default, allowing for an XSS attack. This issue affects: Drupal Drupal Core 7.x versions prior to 7.73; 8.8.x versions prior to 8.8.10; 8.9.x versions prior to 8.9.6;…

    Drupal Drupal core drupal/core drupal/drupal Web / CMS Ubuntu Alpine Packagist