Vulnerability advisory

CVE-2020-13675

Published Feb 11, 2022Updated Oct 24, 2026OSV record ↗

Also known as BIT-drupal-2020-13675DRUPAL-CONTRIB-2021-029DRUPAL-CORE-2021-008GHSA-v8wr-r69p-mmwx

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/drupal/drupal ↗
35c2f3ca5c935f3d8bde15932a712677c9bbd50f to before ff4f28f15d717b1ba39867f1550a248d1a915928	`ff4f28f15d717b1ba39867f1550a248d1a915928`
5c6f14f762c9aef87cd2731818386f202ee8463c to before bdafd0207e0b6d78baa13ac181d9b74ba5e806cd	`bdafd0207e0b6d78baa13ac181d9b74ba5e806cd`
943ecef3c0bc9822338252a7df6419aeb9253c9d to before 4d4e64ff19e7fefad760f223bdb8cf36db9db43e	`4d4e64ff19e7fefad760f223bdb8cf36db9db43e`
Also listed as affected (32) `8.9.18` `9.1.12` `9.2.5` `8.9.17` `9.1.11` `9.2.3` `8.9.16` `9.1.10` `9.2.1` `9.2.0` `9.1.8` `8.9.15` `9.1.6` `9.1.5` `9.1.4` `8.9.12` `9.1.2` `9.1.1` `8.9.11` `9.1.0` `8.9.8` `8.9.5` `8.9.4` `8.9.3` `8.9.2` `8.9.0` `8.9.0-rc1` `8.9.0-beta3` `8.9.0-beta2` `8.9.0-beta1` `8.1.0-beta1` `8.0.0`

Description

Drupal's JSON:API and REST/File modules allow file uploads through their HTTP APIs. The modules do not correctly run all file validation, which causes an access bypass vulnerability. An attacker might be able to upload files that bypass the file validation process implemented by modules on the site.

References

Fixwww.drupal.org/sa-core-2021-008 ↗