CVE-2020-13664

score

<0.1

cvss

8.8

epss

3.0%

published

2021-05-05

kev added

—

first seen

2026-10-21

Drupal Core < 8.8.8, < 8.9.1, < 9.0.1 contains an arbitrary PHP code execution caused by directory creation vulnerability in the file system, letting attackers trick administrators into creating malicious directories to attempt remote code execution, exploit requires administrator to visit a malicious site.