CVE-2026-1556

[CVE catalog]

Severity

High · CVSS 7.7CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Published

Mar 26, 2026, 9:14:20 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.41% · Oct 25, 2026

A flaw was found in Drupal File (Field) Paths. This information disclosure vulnerability allows authenticated users to disclose other users’ private files. This can be exploited by performing filename-collision uploads, which causes the system to receive incorrect file Uniform Resource Identifiers (URIs), thereby bypassing normal access controls on private files. This information disclosure vulnerability in Drupal File (Field) Paths allows authenticated users to access private files belonging to other users. The flaw arises from filename-collision uploads, which can cause the system to process incorrect file URIs and bypass normal access controls on private files within Drupal 7.x installations utilizing the affected module. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.