CVE-2020-13671VulnerabilityPublished 01/18/2022Updated 10/24/2026

CVE-2020-13671: Drupal core Un-restricted Upload of File

Affects Drupal Drupal coreSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 01/18/2022
KEV deadline: 07/18/2022
EPSS: 36.2% chance of exploitation in 30 days – higher than 98% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2020-13671 (opens in a new tab)

Description

CVE-2020-13671 is a vulnerability in Drupal core involving improper sanitization of extension file names, which can lead to un-restricted file uploads. This vulnerability has been exploited in the wild and is considered high severity. No specific affected versions or patch information are provided in the available data.

Summary

Drupal core contains a vulnerability identified as CVE-2020-13671, where improper sanitization of extension file names allows un-restricted file uploads. This flaw is categorized under CWE-434 (Unrestricted Upload of File). The vulnerability has been exploited in the wild, indicating active threat usage. However, no detailed version information or patch availability is provided in the source data.

Impact

The vulnerability enables attackers to upload files without proper restrictions, potentially leading to unauthorized code execution or other malicious activities. Exploitation in the wild confirms active use by threat actors, increasing risk to affected Drupal installations.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until official fixes are confirmed and applied, restrict file upload permissions and monitor for suspicious activity related to file uploads.

Weaknesses

CWE-434Unrestricted File Upload (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 09:57:00 UTC

Weaknesses

References

Related threats