CVE-2020-13675: Unrestricted Upload of File with Dangerous Type in Drupal core
Drupal's JSON:API and REST/File modules allow file uploads through their HTTP APIs. The modules do not correctly run all file validation, which causes an access bypass vulnerability. An attacker might be able to upload files that bypass the file validation process implemented by modules on the site.
Other sources
Unrestricted Upload of File with Dangerous Type in Drupal core
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/coreto a version that resolves this vulnerability.Fixed in 8.9.19 - Upgrade
Upgrade
composer/drupal/coreto a version that resolves this vulnerability.Fixed in 9.2.6 - Upgrade
Upgrade
composer/drupal/coreto a version that resolves this vulnerability.Fixed in 9.1.13
Event History
Frequently Asked Questions
What is CVE-2020-13675?
CVE-2020-13675 is a vulnerability in Drupal's JSON:API and REST/File modules that allows for file uploads that bypass file validation.
What is the severity of CVE-2020-13675?
CVE-2020-13675 has a severity rating of 9.8 (Critical).
Which software versions are affected by CVE-2020-13675?
Drupal versions 8.0.0 to 8.9.19, 9.1.0 to 9.1.13, and 9.2.0 to 9.2.6 are affected by CVE-2020-13675.
How does CVE-2020-13675 work?
CVE-2020-13675 allows attackers to upload files that bypass the file validation process implemented by modules on the Drupal site.
How can I fix CVE-2020-13675?
To fix CVE-2020-13675, it is recommended to update to the latest version of Drupal and apply any available patches.