CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Showing 1โ1 of 1 advisories (Page 1/1)
2020-11-20
Drupal Core Double Extension File Upload Vulnerability (CVE-2020-13671) Analysis and Mitigation Guide
[Affected Scope] Drupal Core versions prior to 9.0.8, 8.9.9, 8.8.11, and 7.74
[Impact] Attackers can upload malicious files with double extensions (e.g., filename.php.txt) to execute arbitrary PHP code (RCE) under certain hosting configurations
[Mitigation] Immediately upgrade Drupal Core to the patched versions (9.0.8, 8.9.9, 8.8.11, 7.74 or higher)