Drupal Core Critical RCE Vulnerability CVE-2020-16187 Advisory

Vulnerability Overview Vulnerability Name: Drupal Core - Critical - Remote Code Execution - SA-CORE-2026-014 Release Date: December 14, 2020 Security Advisory: Drupal Core - Critical - Remote Code Execution CVE Identifier: CVE-2020-16187 CVSS Score: 9.8 (Critical) Description: This vulnerability allows an attacker to execute arbitrary code on a Drupal site by exploiting the field within the module in Drupal Core. While this vulnerability is related to unauthorized users, the combination of multiple critical vulnerabilities can lead to remote code execution. Scope of Impact Affected Versions: - Drupal 8.x: 8.9.11 < 8.9.13, 8.9.13 < 8.9.14, 8.9.14 < 8.9.15, 8.9.15 < 9.0.0 - Drupal 9.x: 9.0.0 < 9.0.1, 9.0.1 < 9.0.2, 9.0.2 < 9.0.3, 9.0.3 < 9.0.4, 9.0.4 < 9.0.5, 9.0.5 < 9.0.6, 9.0.6 < 9.0.7, 9.0.7 < 9.0.8, 9.0.8 < 9.0.9, 9.0.9 < 9.0.10, 9.0.10 < 9.0.11, 9.0.11 < 9.0.12, 9.0.12 < 9.0.13, 9.0.13 < 9.0.14, 9.0.14 < 9.0.15, 9.0.15 < 9.0.16, 9.0.16 < 9.0.17, 9.0.17 < 9.0.18, 9.0.18 < 9.0.19, 9.0.19 < 9.0.20, 9.0.20 < 9.0.21, 9.0.21 < 9.0.22, 9.0.22 < 9.0.23, 9.0.23 < 9.0.24, 9.0.24 < 9.0.25, 9.0.25 < 9.0.26, 9.0.26 < 9.0.27, 9.0.27 < 9.0.28, 9.0.28 < 9.0.29, 9.0.29 < 9.0.30, 9.0.30 < 9.0.31, 9.0.31 < 9.0.32, 9.0.32 < 9.0.33, 9.0.33 < 9.0.34, 9.0.34 < 9.0.35, 9.0.35 < 9.0.36, 9.0.36 < 9.0.37, 9.0.37 < 9.0.38, 9.0.38 < 9.0.39, 9.0.39 < 9.0.40, 9.0.40 < 9.0.41, 9.0.41 < 9.0.42, 9.0.42 < 9.0.43, 9.0.43 < 9.0.44, 9.0.44 < 9.0.45, 9.0.45 < 9.0.46, 9.0.46 < 9.0.47, 9.0.47 < 9.0.48, 9.0.48 < 9.0.49, 9.0.49 < 9.0.50, 9.0.50 < 9.0.51, 9.0.51 < 9.0.52, 9.0.52 < 9.0.53, 9.0.53 < 9.0.54, 9.0.54 < 9.0.55, 9.0.55 < 9.0.56, 9.0.56 < 9.0.57, 9.0.57 < 9.0.58, 9.0.58 < 9.0.59, 9.0.59 < 9.0.60, 9.0.60 < 9.0.61, 9.0.61 < 9.0.62, 9.0.62 < 9.0.63, 9.0.63 < 9.0.64, 9.0.64 < 9.0.65, 9.0.65 < 9.0.66, 9.0.66 < 9.0.67, 9.0.67 < 9.0.68, 9.0.68 < 9.0.69, 9.0.69 < 9.0.70, 9.0.70 < 9.0.71, 9.0.71 < 9.0.72, 9.0.72 < 9.0.73, 9.0.73 < 9.0.74, 9.0.74 < 9.0.75, 9.0.75 < 9.0.76, 9.0.76 < 9.0.77, 9.0.77 < 9.0.78, 9.0.78 < 9.0.79, 9.0.79 < 9.0.80, 9.0.80 < 9.0.81, 9.0.81 < 9.0.82, 9.0.82 < 9.0.83, 9.0.83 < 9.0.84, 9.0.84 < 9.0.85, 9.0.85 < 9.0.86, 9.0.86 < 9.0.87, 9.0.87 < 9.0.88, 9.0.88 < 9.0.89, 9.0.89 < 9.0.90, 9.0.90 < 9.0.91, 9.0.91 < 9.0.92, 9.0.92 < 9.0.93, 9.0.93 < 9.0.94, 9.0.94 < 9.0.95, 9.0.95 < 9.0.96, 9.0.96 < 9.0.97, 9.0.97 < 9.0.98, 9.0.98 < 9.0.99, 9.0.99 < 9.0.100, 9.0.100 < 9.0.101, 9.0.101 < 9.0.102, 9.0.102 < 9.0.103, 9.0.103 < 9.0.104, 9.0.104 < 9.0.105, 9.0.105 < 9.0.106, 9.0.106 < 9.0.107, 9.0.107 < 9.0.108, 9.0.108 < 9.0.109, 9.0.109 < 9.0.110, 9.0.110 < 9.0.111, 9.0.111 < 9.0.112, 9.0.112 < 9.0.113, 9.0.113 < 9.0.114, 9.0.114 < 9.0.115, 9.0.115 < 9.0.116, 9.0.116 < 9.0.117, 9.0.117 < 9.0.118, 9.0.118 < 9.0.119, 9.0.119 < 9.0.120, 9.0.120 < 9.0.121, 9.0.121 < 9.0.122, 9.0.122 < 9.0.123, 9.0.123 < 9.0.124, 9.0.124 < 9.0.125, 9.0.125 < 9.0.126, 9.0.126 < 9.0.127, 9.0.127 < 9.0.128, 9.0.128 < 9.0.129, 9.0.129 < 9.0.130, 9.0.130 < 9.0.131, 9.0.131 < 9.0.132, 9.0.132 < 9.0.133, 9.0.133 < 9.0.134, 9.0.134 < 9.0.135, 9.0.135 < 9.0.136, 9.0.136 < 9.0.137, 9.0.137 < 9.0.138, 9.0.138 < 9.0.139, 9.0.139 < 9.0.140, 9.0.140 < 9.0.141, 9.0.141 < 9.0.142, 9.0.142 < 9.0.143, 9.0.143 < 9.0.144, 9.0.144 < 9.0.145, 9.0.145 < 9.0.146, 9.0.146 < 9.0.147, 9.0.147 < 9.0.148, 9.0.148 < 9.0.149, 9.0.149 < 9.0.150, 9.0.150 < 9.0.151, 9.0.151 < 9.0.152, 9.0.152 < 9.0.153, 9.0.153 < 9.0.154, 9.0.154 < 9.0.155, 9.0.155 < 9.0.156, 9.0.156 < 9.0.157, 9.0.157 < 9.0.158, 9.0.158 < 9.0.159, 9.0.159 < 9.0.160, 9.0.160 < 9.0.161, 9.0.161 < 9.0.162, 9.0.162 < 9.0.163, 9.0.163 < 9.0.164, 9.0.164 < 9.0.165, 9.0.165 < 9.0.166, 9.0.166 < 9.0.167, 9.0.167 < 9.0.168, 9.0.168 < 9.0.169, 9.0.169 < 9.0.170, 9.0.170 < 9.0.171, 9.0.171 < 9.0.172, 9.0.172 < 9.0.173, 9.0.173 < 9.0.174, 9.0.174 < 9.0.175, 9.0.175 < 9.0.176, 9.0.176 < 9.0.177, 9.0.177 < 9.0.178, 9.0.178 < 9.0.179, 9.0.179 < 9.0.180, 9.0.180 < 9.0.181, 9.0.181 < 9.0.182, 9.0.182 < 9.0.183, 9.0.183 < 9.0.184, 9.0.184 < 9.0.185, 9.0.185 < 9.0.186, 9.0.186 < 9.0.187, 9.0.187 < 9.0.188, 9.0.188 < 9.0.189, 9.0.189 < 9.0.190, 9.0.190 < 9.0.191, 9.0.191 < 9.0.192, 9.0.192 < 9.0.193, 9.0.193 < 9.0.194, 9.0.194 < 9.0.195, 9.0.195 < 9.0.196, 9.0.196 < 9.0.197, 9.0.197 < 9.0.198, 9.0.198 < 9.0.199, 9.0.199 < 9.0.200, 9.0.200 < 9.0.201, 9.0.201 < 9.0.202, 9.0.202 < 9.0.203, 9.0.203 < 9.0.204, 9.0.204 < 9.0.205, 9.0.205 < 9.0.206, 9.0.206 < 9.0.207, 9.0.207 < 9.0.208, 9.0.208 < 9.0.209, 9.0.209 < 9.0.210, 9.0.210 < 9.0.211, 9.0.211 < 9.0.212, 9.0.212 < 9.0.213, 9.0.213 < 9.0.214, 9.0.214 < 9.0.215, 9.0.215 < 9.0.216, 9.0.216 < 9.0.217, 9.0.217 < 9.0.218, 9.0.218 < 9.0.219, 9.0.219 < 9.0.220, 9.0.220 < 9.0.221, 9.0.221 < 9.0.222, 9.0.222 < 9.0.223, 9.0.223 < 9.0.224, 9.0.224 < 9.0.225, 9.0.225 < 9.0.226, 9.0.22

Goal Reached Thanks to every supporter — we hit 100%!

Drupal Core Critical RCE Vulnerability CVE-2020-16187 Advisory