Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.9

Drupal 7: Attacker can access private user files

CVE-2026-1556 · published 7 months ago
Summary

Authenticated users can access private files of other users due to a weakness in how Drupal 7 handles file paths. This could allow an attacker to bypass access controls and view files they shouldn't be able to see. Update to version 7.1.3 or later to fix this issue.

What to do
  • Update deciphered filefield_paths to version 7.x-1.3 or later.
Affected software
VendorProductAffected versions
deciphered filefield_paths < 7.x-1.3
cpe:2.3:a:deciphered:filefield_paths:*:*:*:*:*:drupal:*:*
Original advisory text
Information disclosure in the file URI processing of File (Field) Paths in Drupal File (Field) Paths 7.x prior to 7.1.3 on Drupal 7.x allows authenticated users to disclose other users’ private fil...
Information disclosure in the file URI processing of File (Field) Paths in Drupal File (Field) Paths 7.x prior to 7.1.3 on Drupal 7.x allows authenticated users to disclose other users’ private files via filename‑collision uploads. This can cause hook_node_insert() consumers (for example, email attachment modules) to receive the wrong file URI, bypassing normal access controls on private files.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
6.9 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-200Information Exposure
Timeline
Published26 Mar 2026
Updated4 Nov 2026
First seen26 Mar 2026
Sources
CVE-2026-1556 · NVD
Track software like this
Free during beta