GitHub Advisoryadvisory · Packagist

GHSA-68jc-v27h-vhmw Drupal core Unrestricted Upload of File with Dangerous Type

HIGH Published 2021-10-12 Modified 2025-10-22 Official page ↗
Aliases
CVE-2020-13671
Ecosystem
Packagist
Packages
drupal/core, drupal/drupal
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:H
Weaknesses
CWE-434
Reviewed
2021-10-08

Affected packages

• Packagist drupal/core: >= 9.0.0, < 9.0.8 → fixed in 9.0.8 • Packagist drupal/core: >= 8.9.0, < 8.9.9 → fixed in 8.9.9 • Packagist drupal/core: >= 8.0.0, < 8.8.11 → fixed in 8.8.11 • Packagist drupal/core: >= 7.0.0, < 7.74 → fixed in 7.74 • Packagist drupal/drupal: >= 7.0.0, < 7.74 → fixed in 7.74 • Packagist drupal/drupal: >= 8.0.0, < 8.8.11 → fixed in 8.8.11 • Packagist drupal/drupal: >= 8.9.0, < 8.9.9 → fixed in 8.9.9 • Packagist drupal/drupal: >= 9.0.0, < 9.0.8 → fixed in 9.0.8

Description

Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP for certain hosting configurations. This issue affects: Drupal Drupal Core 9.0 versions prior to 9.0.8, 8.9 versions prior to 8.9.9, 8.8 versions prior to 8.8.11, and 7 versions prior to 7.74.

Related

Alias · CVE (1)

  • CVE-2020-13671 Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect… vulnerability

Weakness · CWE (1)

  • CWE-434 Unrestricted Upload of File with Dangerous Type weakness

References