Drupal core - Critical - Remote code execution - SA-CORE-2020-012
https://www.drupal.org/sa-core-2020-012

Project: Drupal core (https://www.drupal.org/project/drupal)Date: 2020-November-18Security risk: Critical 17∕25 AC:Basic/A:User/CI:All/II:All/E:Theoretical/TD:DefaultVulnerability: Remote code executionCVE IDs: CVE-2020-13671Description: Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP for certain hosting configurations.Solution: Install the latest version:
If you are using Drupal 9.0, update to Drupal 9.0.8 (https://www.drupal.org/project/drupal/releases/9.0.8)
If you are using Drupal 8.9, update to Drupal 8.9.9 (https://www.drupal.org/project/drupal/releases/8.9.9)
If you are using Drupal 8.8 or earlier, update to Drupal 8.8.11 (https://www.drupal.org/project/drupal/releases/8.8.11)
If you are using Drupal 7, update to Drupal 7.74 (https://www.drupal.org/project/drupal/releases/7.74)
Versions of Drupal 8 prior to 8.8.x are end-of-life and do not receive security coverage.
Additionally, it's recommended that you audit all previously uploaded files to check for malicious extensions. Look specifically for files that include more than one extension, like .php.txt or .html.gif.Reported By: ufku (https://www.drupal.org/user/9910)
Mark Ferree (https://www.drupal.org/user/76245)
Frédéric G. Marand (https://www.drupal.org/user/27985)
Samuel Mortenson (https://www.drupal.org/user/2582268) of the Drupal Security Team
Derek Wright (https://www.drupal.org/user/46549)
Fixed By: Heine (https://www.drupal.org/user/17943) of the Drupal Security Team
ufku (https://www.drupal.org/user/9910)
Mark Ferree (https://www.drupal.org/user/76245)
Michael Hess (https://www.drupal.org/user/102818) of the Drupal Security Team
David Rothstein (https://www.drupal.org/user/124982) of the Drupal Security Team
Peter Wolanin (https://www.drupal.org/user/49851) of the Drupal Security Team
Jess  (https://www.drupal.org/user/65776) of the Drupal Security Team
Frédéric G. Marand (https://www.drupal.org/user/27985)
Stefan Ruijsenaars (https://www.drupal.org/user/551886)
David Snopek (https://www.drupal.org/user/266527) of the Drupal Security Team
Rick Manelius (https://www.drupal.org/user/680072)
David Strauss (https://www.drupal.org/user/93254) of the Drupal Security Team
Samuel Mortenson (https://www.drupal.org/user/2582268) of the Drupal Security Team
Ted Bowman (https://www.drupal.org/user/240860)
Alex Pott (https://www.drupal.org/user/157725) of the Drupal Security Team
Derek Wright (https://www.drupal.org/user/46549)
Lee Rowlands (https://www.drupal.org/user/395439) of the Drupal Security Team
Kim Pepper (https://www.drupal.org/user/370574)
Wim Leers (https://www.drupal.org/user/99777)
Nate Lampton (https://www.drupal.org/user/35821)
Drew Webber (https://www.drupal.org/user/255969) of the Drupal Security Team
Fabian Franz (https://www.drupal.org/user/693738)
Alex Bronstein (https://www.drupal.org/user/78040) of the Drupal Security Team
Neil Drumm (https://www.drupal.org/user/3064) of the Drupal Security Team
Joseph Zhao (https://www.drupal.org/user/1987218)
Ryan Aslett (https://www.drupal.org/user/391689)

Насколько страшное?

Подскажите, сайт на д6, для счётчика просмотра материала используется модуль quickstats.
Возможно ли сохранить показания счётчиков просмотра при "обновлении" сайта на друпал 8 или 9?
Интересует принципиально возможно или нет. Что бы счёт просмотров продолжился а не начался с нуля на обновленном сайте

ну знаешь, если в бочку мёда добавить ложку говна, то мы получим бочку говна