CVE-2026-1556: Information disclosure via file URI overwrite in File (Field) Paths
Information disclosure in the file URI processing of File (Field) Paths in Drupal File (Field) Paths 7.x prior to 7.1.3 on Drupal 7.x allows authenticated users to disclose other users’ private files via filename‑collision uploads. This can cause hooknodeinsert() consumers (for example, email attachment modules) to receive the wrong file URI, bypassing normal access controls on private files.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-1556?
CVE-2026-1556 has a moderately critical severity rating due to potential information disclosure.
How do I fix CVE-2026-1556?
To fix CVE-2026-1556, upgrade the Drupal File (Field) Paths module to version 7.1.3 or later.
What types of attacks can CVE-2026-1556 facilitate?
CVE-2026-1556 can facilitate attacks that lead to information disclosure of private files through filename-collision uploads.
Who is affected by CVE-2026-1556?
Authenticated users of Drupal File (Field) Paths versions prior to 7.1.3 are affected by CVE-2026-1556.
What versions of Drupal are vulnerable to CVE-2026-1556?
Versions of Drupal File (Field) Paths prior to 7.1.3 are vulnerable to CVE-2026-1556.