Drupal core Ausführung von beliebigem PHP-Code

The core of the vulnerability lies in how Drupal Core handles filenames with .htaccess extensions. Due to a flaw in the sanitization process, an attacker could upload a malicious .htaccess file, bypassing Drupal's default protections. This could lead to remote code execution (RCE) on the Apache web server hosting the Drupal site. The blast radius is significant, as successful exploitation could grant the attacker complete control over the server. This is similar to vulnerabilities that exploit misconfigured server files to gain unauthorized access.

1. Reserviert2022-02-16
2. Veröffentlicht2023-04-26
3. Geändert2025-02-03
4. EPSS aktualisiert2026-04-02

The recommended mitigation is to upgrade Drupal Core to version 9.3.19 or later. Prior to upgrading, ensure that file upload permissions are properly configured and that only authorized file types are allowed. Consider implementing a Web Application Firewall (WAF) to filter potentially malicious file uploads. If an upgrade is not immediately feasible, restrict file upload permissions and carefully review all uploaded files for suspicious content. Implement stricter file extension whitelisting to prevent the upload of potentially dangerous files.