# CVE-2020-13671: Drupal core Un-restricted Upload of File

- Exploited (CISA KEV): yes, added 2022-01-18
- Published: 2020-11-20
- CVSS: 8.8 HIGH (v3.1)
- EPSS: 36.2% (98th percentile)
- CWE: CWE-434

Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP for certain hosting configurations. This issue affects: Drupal Drupal Core 9.0 versions prior to 9.0.8, 8.9 versions prior to 8.9.9, 8.8 versions prior to 8.8.11, and 7 versions prior to 7.74.

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | Before feed history | — | — |
| AWS | No public claim | — | — |
| Microsoft Azure | No public claim | — | — |
| Google Cloud | Before feed history | — | — |
| Fastly | Before feed history | — | — |
| F5 | Rule published | 2025-12-03 | 1839 |
| Akamai | No public source | — | — |
| OWASP CRS | Before feed history | — | — |

### F5

- 2025-12-03 · new · rule 200020233
  > Added: signature 200020233 "Drupal Core Unrestricted File Upload" (Malicious File Upload, risk High), systems: PHP. References: CVE-2020-13671.
  Source: https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2020-13671 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2020-13671