Packagist/drupal/core CVE-2020-13671: unknown, exploited, EPSS 36.17%

*Update November 18: Documented longer list of dangerous file extensions*

Action: Upgrade drupal/core to 8.8.11 or later.

composer require drupal/core:8.8.11

composer require drupal/core:8.9.9

composer require drupal/core:9.0.8

Affected

Fixed versions

Sources

• osv: DRUPAL-CORE-2020-012
• kev: CVE-2020-13671
• https://www.drupal.org/sa-core-2020-012

CVE-2020-13671 · published 2020-11-18T17:18:31Z · modified 2026-09-19T17:38:35Z · JSON