CVE-2026-1556
Information Disclosure in Drupal 7.x File (Field) Paths Module
Publication date: 2026-03-26
Last updated on: 2026-04-02
Assigner: Drupal.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| deciphered | filefield_paths | to 7.x-1.3 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-200 | The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an information disclosure issue in Drupal 7.x versions prior to 7.1.3 related to the processing of file URIs in File (Field) Paths. Authenticated users can exploit filename-collision uploads to access other users' private files. This happens because the system may provide incorrect file URIs to certain consumers, such as email attachment modules, bypassing the normal access controls that protect private files.
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized disclosure of private files belonging to other users. This means that sensitive or confidential information stored in private files could be exposed to authenticated users who should not have access, potentially leading to privacy breaches or data leaks.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows authenticated users to disclose other users’ private files due to improper file URI processing and filename-collision uploads in Drupal 7.x prior to 7.1.3. Such unauthorized disclosure of private files can lead to violations of data protection and privacy requirements mandated by standards like GDPR and HIPAA, which require strict access controls and protection of personal and sensitive information.
By bypassing normal access controls on private files, this vulnerability increases the risk of unauthorized data exposure, potentially resulting in non-compliance with regulations that mandate confidentiality and integrity of user data.