CVE-2026-1556
Description
A flaw was found in Drupal File (Field) Paths. This information disclosure vulnerability allows authenticated users to disclose other users’ private files. This can be exploited by performing filename-collision uploads, which causes the system to receive incorrect file Uniform Resource Identifiers (URIs), thereby bypassing normal access controls on private files.
Statement
This information disclosure vulnerability in Drupal File (Field) Paths allows authenticated users to access private files belonging to other users. The flaw arises from filename-collision uploads, which can cause the system to process incorrect file URIs and bypass normal access controls on private files within Drupal 7.x installations utilizing the affected module.
Understanding the Weakness (CWE)
Integrity,Confidentiality
Technical Impact: Read Files or Directories; Modify Files or Directories
The application can operate on unexpected files. Confidentiality is violated when the targeted filename is not directly readable by the attacker.
Integrity,Confidentiality,Availability
Technical Impact: Modify Files or Directories; Execute Unauthorized Code or Commands
The application can operate on unexpected files. This may violate integrity if the filename is written to, or if the filename is for a program or other form of executable code.
Availability
Technical Impact: DoS: Crash, Exit, or Restart; DoS: Resource Consumption (Other)
The application can operate on unexpected files. Availability can be violated if the attacker specifies an unexpected file that the application modifies. Availability can also be affected if the attacker specifies a filename for a large file, or points to a special device or a file that does not have the format that the application expects.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
