Packagist/drupal/core CVE-2020-13675: critical 9.8, EPSS 1.39%

Drupal's JSON:API and REST/File modules allow file uploads through their HTTP APIs. The modules do not correctly run all file validation, which causes an access bypass vulnerability. An attacker might

Action: Upgrade drupal/core to 8.9.19 or later.

composer require drupal/core:8.9.19

composer require drupal/core:9.1.13

composer require drupal/core:9.2.6

Affected

introduced	fixed	last affected
8.0.0	8.9.19	-
9.1.0	9.1.13	-
9.2.0	9.2.6	-

Fixed versions

8.9.19

9.1.13

9.2.6

Sources

osv: DRUPAL-CORE-2021-008
nvd: CVE-2020-13675
https://www.drupal.org/sa-core-2021-008

CVE-2020-13675 · published 2021-09-15T15:22:27Z · modified 2026-09-19T16:55:15Z · JSON