# CVE-2020-13671

Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP for certain hosting configurations. This issue affects: Drupal Drupal Core 9.0 versions prior to 9.0.8, 8.9 versions prior to 8.9.9, 8.8 versions prior to 8.8.11, and 7 versions prior to 7.74.

- Page: https://www.vulneraibility.com/cve/CVE-2020-13671
- CVSS: 8.8
- Known exploited: yes, in CISA KEV since 2022-01-18; CISA due date 2022-07-18
- EPSS: 30.95% (percentile 98.3)
- Unvetted proof-of-concept code on GitHub: 3 GitHub proofs of concept (first 2026-08-22)
- CISA SSVC: exploitation active, automatable no, technical impact total (assessed 2025-02-07)
- Weakness: CWE-434
- Also known as: GHSA-68jc-v27h-vhmw
- Published: 2020-11-20

## Affected versions

- drupal: affected >= 7.0.0 and < 7.74.0; >= 8.8.0 and < 8.8.11; >= 8.9.0 and < 8.9.9; >= 9.0.0 and < 9.0.8; fixed in 7.74.0, 8.8.11, 8.9.9, 9.0.8 (Bitnami advisory, via OSV)
- Drupal Drupal Core: affected 9.0 versions prior to 9.0.8; 8.9 versions prior to 8.9.9; 8.8 versions prior to 8.8.11; 7 versions prior to 7.74

A version outside these ranges is not a statement that it is unaffected.

## References

- [other] https://www.drupal.org/sa-core-2020-012
- [advisory] https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KWM4CTMEGAC4I2CHYNJVSROY4CVXVEUT/
- [advisory] https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5KSFM672XW3X6BR7TVKRD63SLZGKK437/
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-13671

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.