CISA KEV catalog
Confirmed active exploitation.
Listed in CISA's catalog of Known Exploited Vulnerabilities: attackers are using it in real attacks. Patch it with priority.
- Name
- Drupal core Un-restricted Upload of File
- Added to catalog
- Remediation due date (US federal)
- Required action
- Apply updates per vendor instructions.
Description
Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP for certain hosting configurations. This issue affects: Drupal Drupal Core 9.0 versions prior to 9.0.8, 8.9 versions prior to 8.9.9, 8.8 versions prior to 8.8.11, and 7 versions prior to 7.74.
Affected products
drupal: drupal; fedoraproject: fedora
References7
- www.drupal.org/sa-core-2020-012 Vendor Advisory
- www.drupal.org/sa-core-2020-012 Vendor Advisory
- lists.fedoraproject.org/archives/list/package-announce%40lists.… Mailing ListRelease Notes
- lists.fedoraproject.org/archives/list/package-announce%40lists.… Mailing ListRelease Notes
- lists.fedoraproject.org/archives/list/package-announce%40lists.… Mailing ListRelease Notes
- lists.fedoraproject.org/archives/list/package-announce%40lists.… Mailing ListRelease Notes
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=… US Government Resource
Metrics
- CVSS 3.1
-
8.8
HIGH
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 36% percentile: 98 · as of 2 November 2026
- CWE
- CWE-434
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.