2 ms·
Drupal RCE via file upload (abc.html.txt, filename.php.gif)
- axsharma 6y agoThe vulnerability also tracked as SA-CORE-2020-012, exists due to improper validation of filenames of files uploaded to Drupal websites. E.g. filename.php.txt or filename.html.gif, without an underscore (_) in the extension.