Skip to content
OpenAdvisories
High · 8.8 Known exploited Public exploit CVE-2020-13671 BIT-drupal-2020-13671DRUPAL-CORE-2020-012EUVD-2021-2168GHSA-68jc-v27h-vhmw

Drupal core Unrestricted Upload of File with Dangerous Type

Published Nov 20, 2020 · Updated Oct 21, 2025 · Assigned by drupal

Vendor: Drupal Product: Drupal core Package: drupal/core Package: drupal/drupal Package: drupal7 Package: drupal7 Category: Web / CMS Ecosystem: Alpine Ecosystem: Packagist Ecosystem: Ubuntu

Description

Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP for certain hosting configurations. This issue affects: Drupal Drupal Core 9.0 versions prior to 9.0.8, 8.9 versions prior to 8.9.9, 8.8 versions prior to 8.8.11, and 7 versions prior to 7.74.

Affected products

VendorProductAffectedFixed
Drupal Drupal Core 9.0 versions prior to 9.0.8, 8.9 versions prior to 8.9.9, 8.8 versions prior to 8.8.11, 7 versions prior to 7.74 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 9 drupal7 7.52-2+deb9u12 DLA-2458-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu Pro 16.04 LTS drupal7 7.44-1ubuntu1~16.04.0+esm2 USN-6981-1
Ubuntu Pro 14.04 LTS drupal7 7.26-1ubuntu0.1+esm2 USN-6981-2

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.20 drupal7 7.74-r0 —
Alpine v3.19 drupal7 7.74-r0 —
Alpine v3.18 drupal7 7.74-r0 —
Alpine v3.17 drupal7 7.74-r0 —
Alpine v3.16 drupal7 7.74-r0 —
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Alpine v3.15 drupal7 7.74-r0 —
Alpine v3.14 drupal7 7.74-r0 —
Alpine v3.13 drupal7 7.74-r0 —
Alpine v3.12 drupal7 7.74-r0 —
Alpine v3.11 drupal7 7.74-r0 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 4 repositories

  • d4ytox/CVE-2020-13671 ★ 1 · Nov 10, 2026

    Unrestricted file upload to RCE in Drupal core (<7.74, <8.8.11, <8.9.9, <9.0.8). Drupal never munges a bare dangerous extension, so shell.php survives as shell.php.txt. Anonymous registration and aut…

  • ivanesk315/CVE-2020-13671 ★ 0 · Sep 10, 2026
  • Dungsocool/CVE-2020-13671 ★ 0 · Aug 22, 2026

    CVE-2020-13671 - Drupal RCE via File Upload Vulnerability Analysis and PoC

  • Dungsocool/CVE-2020-13671-old ★ 0 · Aug 22, 2026

    CVE-2020-13671 - Drupal RCE via File Upload Vulnerability Analysis and PoC

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
Packagist drupal/core >= 8.0.0, < 8.8.11 · >= 8.9.0, < 8.9.9 · >= 9.0.0, < 9.0.8 8.8.11, 8.9.9, 9.0.8 DRUPAL-CORE-2020-012
Packagist drupal/core >= 9.0.0, < 9.0.8 9.0.8 GHSA-68jc-v27h-vhmw
Packagist drupal/core >= 8.9.0, < 8.9.9 8.9.9 GHSA-68jc-v27h-vhmw
Packagist drupal/core >= 8.0.0, < 8.8.11 8.8.11 GHSA-68jc-v27h-vhmw
Packagist drupal/core >= 7.0.0, < 7.74 7.74 GHSA-68jc-v27h-vhmw
Packagist drupal/drupal >= 7.0.0, < 7.74 7.74 GHSA-68jc-v27h-vhmw
Packagist drupal/drupal >= 8.0.0, < 8.8.11 8.8.11 GHSA-68jc-v27h-vhmw
Packagist drupal/drupal >= 8.9.0, < 8.9.9 8.9.9 GHSA-68jc-v27h-vhmw
Packagist drupal/drupal >= 9.0.0, < 9.0.8 9.0.8 GHSA-68jc-v27h-vhmw

Advisories 4

References