Improper access control in Drupal Core
Priority MEDIUM 45CWE-284Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass, Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-284 and CWE-434.
Summary
Drupal's JSON:API and REST/File modules allow file uploads through their HTTP APIs. The modules do not correctly run all file validation, which causes an access bypass vulnerability. An attacker might be able to upload files that bypass the file validation process implemented by modules on the site.
Why it matters now
EPSS 0.01385 72nd percentileScored 2026-11-07
Fix Fixed Core (Drupal): 9.2.6, 9.1.13, 8.9.19drupal/core (Packagist): 8.9.19, 9.1.13, 9.2.6
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Drupal | Core | 9.2.x to before 9.2.6; 9.1.x to before 9.1.13; 8.9.x to before 8.9.19 | 9.2.6, 9.1.13, 8.9.19 | Patch available | CNA |
| — | drupal/core (Packagist) | 8.0.0 to before 8.9.19 | 8.9.19 | Patch available | GHSA-v8wr-r69p-mmwx |
| — | drupal/core (Packagist) | 9.1.0 to before 9.1.13 | 9.1.13 | Patch available | GHSA-v8wr-r69p-mmwx |
| — | drupal/core (Packagist) | 9.2.0 to before 9.2.6 | 9.2.6 | Patch available | GHSA-v8wr-r69p-mmwx |
- Core VendorDrupal Affected 9.2.x to before 9.2.6; 9.1.x to before 9.1.13; 8.9.x to before 8.9.19 Fixed in 9.2.6, 9.1.13, 8.9.19 Patch available CNA
- drupal/core (Packagist) Vendor— Affected 8.0.0 to before 8.9.19 Fixed in 8.9.19 Patch available GHSA-v8wr-r69p-mmwx
- drupal/core (Packagist) Vendor— Affected 9.1.0 to before 9.1.13 Fixed in 9.1.13 Patch available GHSA-v8wr-r69p-mmwx
- drupal/core (Packagist) Vendor— Affected 9.2.0 to before 9.2.6 Fixed in 9.2.6 Patch available GHSA-v8wr-r69p-mmwx
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* | 8.0.0 to before 8.9.19; 9.1.0 to before 9.1.13; 9.2.0 to before 9.2.6 | Vulnerable | Drupal |
- cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* Versions 8.0.0 to before 8.9.19; 9.1.0 to before 9.1.13; 9.2.0 to before 9.2.6 Vulnerable ·Drupal
Remediation
- Fix · CNA Core (Drupal) Fixed in 9.2.6, 9.1.13, 8.9.19
- Fix · GHSA-v8wr-r69p-mmwx drupal/core (Packagist) Fixed in 8.9.19 Advisory →
- Fix · GHSA-v8wr-r69p-mmwx drupal/core (Packagist) Fixed in 9.1.13 Advisory →
- Fix · GHSA-v8wr-r69p-mmwx drupal/core (Packagist) Fixed in 9.2.6 Advisory →
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Drupal Core 8.9.19, 9.1.13, 9.2.6
4 records Highest priority Priority MEDIUM 1 MEDIUM, 3 LOW
Other records, highest priority first
- TI-2020-10737 Improper access control in Drupal CorePriority LOW 35
- TI-2020-10736 Improper access control in Drupal CorePriority LOW 30
- TI-2020-10734 Cross-site request forgery in Drupal CorePriority LOW 29
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2020-13675
- 2026-10-03 Alias added: GHSA-v8wr-r69p-mmwx
References
More Drupal vulnerabilities
- TI-2026-07979 Drupal core - Highly critical - SQL injection - SA-CORE-2026-004 KEVCVSS 3.1CRITICAL 9.8
- TI-2018-05494 Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-004 KEVCVSS 3.1CRITICAL 9.8
- TI-2018-05493 Improper input validation in Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6… KEVCVSS 3.1CRITICAL 9.8
- TI-2020-10731 Unrestricted file upload in Drupal Core KEVCVSS 3.1HIGH 8.8
- TI-2019-04505 Drupal core - Highly critical - Remote Code Execution KEVCVSS 3.1HIGH 8.1
- TI-2020-17477 Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks… KEVCVSS 3.1HIGH 7.8
Sources
- CVE-2020-13675 · CVE Program
- CVE-2020-13675 · NVD
- FIRST EPSS
- GHSA-v8wr-r69p-mmwx · GitHub Advisory Database · CC BY 4.0
- CVE-2020-13675 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences