Drupal emergency updates fix critical arbitrary PHP code execution

CVE-2020-13671 is a file-upload flaw in Drupal core: improper sanitization of uploaded file names and their extensions allows a submitted file to bypass the allowed-extension checks (CWE-434, Unrestricted Upload of File with Dangerous Type). It is triggered when a user with upload privileges submits a crafted file name (for example, one carrying a dangerous or double extension) through any Drupal form or API path that stores uploaded files. An attacker gains the ability to plant arbitrary files on the server, and on sites where the web server executes uploaded files this can escalate to full remote code execution and site compromise. Any site running an affected release of Drupal core is exposed; the provided data lists 'Drupal core' as the affected product without enumerating version ranges. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2022-01-18, confirming exploitation in the wild (ransomware use unknown), and EPSS assigns a 35.4% probability of exploitation within 30 days.

Do: Update Drupal core to the patched release specified in the vendor's security advisory (CISA required action: apply updates per vendor instructions). Until patched, restrict which roles can upload files, enforce strict allowed-extension lists, and ensure the public upload directory is configured so the web server does not execute uploaded files as scripts. Given the KEV listing, inspect upload directories and web logs for unexpected files or web shells.

Archive_Tar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked.

PEAR's Archive_Tar library through version 1.4.10 sanitizes archive filenames only against phar:// stream-wrapper attacks, leaving all other PHP stream wrappers open to abuse; an attacker who controls an archive's filename can, for example, use the file:// wrapper to write files outside the intended directory. The flaw is triggered whenever a vulnerable application creates or extracts an archive using an attacker-influenced filename, as in Drupal core, which shipped emergency out-of-band updates because the file-write primitive allowed arbitrary PHP code execution. An attacker gains arbitrary file overwrite, and in web application contexts such as Drupal this can escalate to remote code execution by writing executable PHP into the web root. Any PHP application using the library is affected, including Drupal core and the Archive_Tar packages shipped by Debian and Fedora. Exploitation is confirmed: the flaw is in CISA's Known Exploited Vulnerabilities Catalog (added 2022-08-25), carries a very high 84.6% EPSS probability of exploitation within 30 days, and public proof-of-concept exploits are available.

Do: Upgrade Archive_Tar to a version after 1.4.10 (1.4.11 fixes this flaw) and apply the emergency Drupal core security updates or the corresponding Debian/Fedora package updates per vendor instructions. Audit any application that passes attacker-controlled filenames or paths to Archive_Tar and consider rejecting or strictly validating filenames containing stream wrappers (e.g., '://'). Because this flaw is in CISA's Known Exploited Vulnerabilities Catalog, patch promptly to meet the catalog's required action deadlines.