Actively exploited in the wild
Drupal core Un-restricted Upload of File
Drupal - Drupal core · Listed in the CISA KEV since 2022-01-18. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2020-13671
HighCVSS 8.8KEVSummary
Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP for certain hosting configurations. This issue affects Drupal Core 9.0 versions prior to 9.0.8, 8.9 prior to 8.9.9, 8.8 prior to 8.8.11, and 7 prior to 7.74.
Risk Assessment
An attacker could upload a malicious file that gets executed as PHP, potentially leading to remote code execution and site compromise. However, file upload capability is required.
Recommendation
Update Drupal core to version 9.0.8, 8.9.9, 8.8.11, or 7.74 (or later). It is also recommended to review server configuration for PHP execution.
Other vulnerabilities in Drupal Core
See all- CVE-2026-55805Medium
Drupal core has a Stored XSS vulnerability due to improper neutralization of input during web page generation. Affected versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, and some 11.0.*, 11.1.*, 11.2.* versions.
- CVE-2026-15917Medium
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects versions: from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, and all versions up to 11.2.*.
- CVE-2026-15916Medium
Missing Authorization vulnerability in Drupal Drupal core allows Forceful Browsing. This issue affects versions: up to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, and all versions up to 11.0.*, 11.1.*, and 11.2.*.
- CVE-2026-55808Medium
A Cross-Site Scripting (XSS) vulnerability has been discovered in Drupal Core due to improper input neutralization during web page generation. It affects a wide range of versions: from 0.0.0 to 10.5.12, 10.6.0-10.6.11, 11.2.0-11.2.14, 11.3.0-11.3.12, and all 11.0.* and 11.1.* releases.
- CVE-2026-55807Low
SSRF vulnerability in Drupal core allows an attacker to send requests from the server to internal network resources. The issue affects multiple Drupal versions including 10.5.x, 10.6.x, 11.2.x, 11.3.x, and older branches 11.0.x and 11.1.x.
- CVE-2026-55806Medium
An Open Redirect vulnerability in Drupal core allows URL redirection to untrusted sites, enabling content spoofing. This affects Drupal core versions from 0.0.0 to 10.5.12, 10.6.0 to 10.6.11, 11.2.0 to 11.2.14, 11.3.0 to 11.3.12, and older branches 11.0.* and 11.1.*.
- CVE-2026-55804Medium
An improperly controlled modification of dynamically-determined object attributes vulnerability in Drupal core allows object injection. Affected versions include Drupal core from 0.0.0 to 10.5.12, 10.6.0 to 10.6.11, 11.2.0 to 11.2.14, 11.3.0 to 11.3.12, and branches 11.0.* and 11.1.*.
- CVE-2026-55803Medium
An improperly controlled modification of dynamically-determined object attributes vulnerability in Drupal core allows object injection. This affects Drupal core versions from 0.0.0 to 10.5.12, 10.6.0 to 10.6.11, 11.2.0 to 11.2.14, 11.3.0 to 11.3.12, and older branches 11.0.* and 11.1.*.
- CVE-2026-6367Medium
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core: from 11.3.0 before 11.3.7.
- CVE-2026-6366Medium
Improperly controlled modification of dynamically-determined object attributes vulnerability in Drupal core allows object injection. Affects versions from 8.0.0 before 10.5.9, from 10.6.0 before 10.6.7, from 11.0.0 before 11.2.11, and from 11.3.0 before 11.3.7.
Original NVD description (English source)
Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP for certain hosting configurations. This issue affects: Drupal Drupal Core 9.0 versions prior to 9.0.8, 8.9 versions prior to 8.9.9, 8.8 versions prior to 8.8.11, and 7 versions prior to 7.74.