CVE-2020-13671: 
PHP vulnerability analysis and mitigation

CVE-2020-13671 is a security vulnerability in Drupal core that was disclosed on November 20, 2020. The vulnerability stems from improper sanitization of certain filenames on uploaded files, which can lead to files being interpreted with incorrect extensions and served with wrong MIME types or executed as PHP code in certain hosting configurations. This vulnerability affects multiple versions of Drupal Core including 9.0 versions prior to 9.0.8, 8.9 versions prior to 8.9.9, 8.8 versions prior to 8.8.11, and 7 versions prior to 7.74 (NVD).

The vulnerability has been assigned a CVSS v3.1 Base Score of 8.8 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. This indicates that the vulnerability can be exploited over the network, requires low attack complexity, needs low privileges, requires no user interaction, has unchanged scope, and can result in high impact to confidentiality, integrity, and availability (NVD).

The vulnerability can allow remote attackers to execute arbitrary code through improper filename sanitization. This could potentially lead to complete system compromise with high impacts on confidentiality, integrity, and availability of the affected system (Ubuntu Security).

The vulnerability has been added to CISA's Known Exploited Vulnerabilities Catalog on January 18, 2022, indicating that it has been actively exploited in the wild. The due date for required action was set to July 18, 2022 (NVD).

The vulnerability has been patched in Drupal Core versions 9.0.8, 8.9.9, 8.8.11, and 7.74. Users are strongly advised to upgrade to these versions or later. For Ubuntu systems, security updates have been released for various versions including Ubuntu 14.04 ESM (drupal7 version 7.26-1ubuntu0.1+esm2) and Ubuntu 16.04 ESM (drupal7 version 7.44-1ubuntu1~16.04.0+esm2) (Ubuntu Security).