CVE-2020-13671

What is Drupal Core?

Drupal is one of the most widely used open-source content management systems, powering everything from government agency websites to large enterprise portals. "Drupal core" refers to the base CMS installation itself, as distinct from the thousands of contributed modules built on top of it — a vulnerability in core affects every Drupal site regardless of which modules are installed.

Overview

CVE-2020-13671 is an unrestricted file upload vulnerability (CWE-434) in Drupal core, fixed via Security Advisory SA-CORE-2020-002 in July 2020. Certain filenames can be crafted so that Drupal's extension-sanitization logic fails to correctly identify and block a dangerous file type, allowing a low-privileged authenticated user (anyone permitted to upload files, such as a low-permission content editor) to upload a file that gets executed by the web server rather than treated as inert content (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8 High).

Technical Details

Drupal core, like many CMS platforms, filters uploaded file extensions to prevent scripts (e.g., .php) from being uploaded and later executed by the web server. The vulnerability is that certain crafted filenames — such as ones using trailing whitespace, extra dots, or unusual character sequences — could bypass this extension check while still being processed by the underlying web server or file system in a way that resulted in the file being treated as executable code, defeating the sanitization the CMS relied on.

Discovery

Reported to the Drupal Security Team through Drupal's standard responsible disclosure process ahead of the July 2020 SA-CORE-2020-002 advisory.

Exploitation Context

CISA added this CVE to KEV in January 2022 based on confirmed exploitation. File-upload bypass vulnerabilities of this kind are attractive to attackers because they turn a comparatively low privilege level (any account with file-upload permission, not necessarily a full administrator) directly into remote code execution, a much larger jump in impact than the nominal privilege level would suggest.

Remediation

1. Update Drupal core to the version specified in SA-CORE-2020-002 or later immediately.
2. Review which user roles have file-upload permissions and restrict them to the minimum necessary — this vulnerability's real-world severity depends heavily on how many accounts could reach the vulnerable upload functionality.
3. Audit uploaded files directories for unexpected executable content if the site has not been patched or audited since mid-2020.
4. Ensure the web server is configured to never execute scripts from user-upload directories, regardless of CMS-level extension filtering, as defense-in-depth against this entire vulnerability class.