{"action":"Upgrade drupal/drupal to 7.74 or later.","affected":[{"fixed":"7.74","introduced":"7.0.0"},{"fixed":"8.8.11","introduced":"8.0.0"},{"fixed":"8.9.9","introduced":"8.9.0"},{"fixed":"9.0.8","introduced":"9.0.0"}],"component":"drupal/drupal","cve_ids":["CVE-2020-13671"],"ecosystem":"Packagist","epss":0.36167,"exploited":true,"fixed_versions":["7.74","8.8.11","8.9.9","9.0.8"],"ghsa_id":"GHSA-68jc-v27h-vhmw","id":"tcs_01M5KEWVKF2BBJMAS9CSDHH8R8","modified_at":"2025-12-10T23:41:21.622533Z","published_at":"2021-10-12T16:28:25Z","references":["https://osv.dev/vulnerability/GHSA-68jc-v27h-vhmw","https://nvd.nist.gov/vuln/detail/CVE-2020-13671","https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2020-13671.yaml","https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2020-13671.yaml","https://github.com/drupal/core","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5KSFM672XW3X6BR7TVKRD63SLZGKK437","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KWM4CTMEGAC4I2CHYNJVSROY4CVXVEUT","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5KSFM672XW3X6BR7TVKRD63SLZGKK437","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KWM4CTMEGAC4I2CHYNJVSROY4CVXVEUT","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-13671","https://www.drupal.org/sa-core-2020-012"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-68jc-v27h-vhmw#Packagist/drupal/drupal","url":"https://osv.dev/vulnerability/GHSA-68jc-v27h-vhmw"},{"source":"kev","source_id":"CVE-2020-13671","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"}],"summary":"Drupal core Unrestricted Upload of File with Dangerous Type"}