CISA description
Improper sanitization in the extension file names is present in Drupal core.
CVE-2020-13671
Drupal · Drupal core
Drupal core Un-restricted Upload of File
Required action
Apply updates per vendor instructions.
Notes & references
Where this lands in 800-53
Vulnerability data triggers these controls during assessment and continuous monitoring.