onyx

onyx --cves cve-2020-13671

CVE-2020-13671

HIGHKEVPOCDrupal
score
0.4
cvss
8.8
epss
36.2% ▲0.8
published
2020-11-20
kev added
2022-01-18
first seen

Drupal core < 9.0.8, < 8.9.9, < 8.8.11, and < 7.74 contain a filename sanitization issue caused by improper handling of uploaded filenames, letting files be interpreted as incorrect types or executed as PHP, exploit requires file upload by authenticated users.

Timeline

How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.

events2020-11-20 — PublishedP2022-01-18 — Added to CISA KEVK2026-10-21 (seen by) — Tracked by OnyxT2026-10-21 (seen by) — Public PoCXscore2026-10-21: score 0.40.4epss2026-09-22: epss 35.4%2026-09-23: epss 35.4%2026-09-24: epss 35.4%2026-09-25: epss 35.4%2026-09-26: epss 35.4%2026-09-27: epss 35.4%2026-09-28: epss 35.4%2026-09-29: epss 35.4%2026-09-30: epss 35.4%2026-10-01: epss 35.4%2026-10-02: epss 35.4%2026-10-03: epss 35.4%2026-10-04: epss 35.4%2026-10-05: epss 35.4%2026-10-06: epss 35.4%2026-10-07: epss 35.4%2026-10-08: epss 35.4%2026-10-09: epss 35.4%2026-10-10: epss 35.4%2026-10-11: epss 35.4%2026-10-12: epss 35.4%2026-10-13: epss 35.4%2026-10-14: epss 35.4%2026-10-15: epss 35.4%2026-10-16: epss 35.4%2026-10-18: epss 36.2%2026-10-19: epss 36.2%2026-10-20: epss 36.2%2026-10-21: epss 36.2%36.2%mentions/day0no mentions in 30 days2026-09-22today
  1. Published
  2. Added to CISA KEV
  3. Tracked by Onyx
  4. Public PoC

Exploit availability

Public PoC flagged by vulnx; no direct exploit link among the citations.

Weaknesses

CWE-434

References 8