Arbitrary PHP Code Execution Vulnerability in Drupal Core by Drupal

CVE-2020-13664

Summary

This vulnerability in Drupal Core allows for arbitrary PHP code execution under specific conditions. An attacker may deceive an administrator into visiting a malicious page, resulting in the creation of a specially named directory on the server's filesystem. This directory could potentially be exploited to brute-force a remote code execution vector, affecting primarily Windows server configurations. Multiple versions of Drupal Core prior to certain updates are susceptible to this security issue, highlighting the importance of timely patches and secure practices.

References