CVE-2020-13671: Unrestricted Upload of File with Dangerous Type

November 20, 2020 (updated December 15, 2020)

Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP for certain hosting configurations.

References

nvd.nist.gov/vuln/detail/CVE-2020-13671
www.drupal.org/sa-core-2020-012

Code Behaviors & Features

Detect and mitigate CVE-2020-13671 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →