CVE-2026-1556

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1556", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "state": "PUBLISHED", "assignerShortName": "drupal", "dateReserved": "2026-01-28T17:20:34.800Z", "datePublished": "2026-03-26T21:14:20.549Z", "dateUpdated": "2026-03-27T19:39:20.961Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2026-03-26T21:14:20.549Z"}, "title": "Information disclosure via file URI overwrite in File (Field) Paths", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-17", "descriptions": [{"lang": "en", "value": "CAPEC-17 Using Malicious Files"}]}], "affected": [{"vendor": "Drupal", "product": "Drupal File (Field) Paths", "platforms": ["Drupal 7.x"], "collectionURL": "https://www.drupal.org/project/filefield_paths", "packageName": "File (Field) Paths", "repo": "http://git.drupalcode.org/project/filefield_paths", "versions": [{"status": "affected", "version": "7.x-1.0", "lessThan": "7.x-1.3", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Information disclosure in the file URI processing of File (Field) Paths in Drupal File (Field) Paths 7.x prior to 7.1.3 on Drupal 7.x allows authenticated users to disclose other users\u2019 private files via filename\u2011collision uploads. This can cause hook_node_insert() consumers (for example, email attachment modules) to receive the wrong file URI, bypassing normal access controls on private files.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Information disclosure in the file URI processing of File (Field) Paths in Drupal File (Field) Paths 7.x prior to 7.1.3 on Drupal 7.x allows authenticated users to disclose other users\u2019 private files via filename\u2011collision uploads. This can cause hook_node_insert() consumers (for example, email attachment modules) to receive the wrong file URI, bypassing normal access controls on private files."}]}], "references": [{"url": "https://www.herodevs.com/vulnerability-directory/cve-2026-1556", "tags": ["third-party-advisory"]}, {"url": "https://d7es.tag1.com/security-advisories/file-field-paths-moderately-critical-file-path-manipulation", "tags": ["third-party-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "subConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 6.9, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N"}}], "credits": [{"lang": "en", "value": "Michael Hess (mlhess)", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1556", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-27T19:28:14.455549Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-27T19:39:20.961Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1556", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-27T19:28:14.455549Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-27T19:30:48.890Z"}}], "cna": {"title": "Information disclosure via file URI overwrite in File (Field) Paths", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Michael Hess (mlhess)"}], "impacts": [{"capecId": "CAPEC-17", "descriptions": [{"lang": "en", "value": "CAPEC-17 Using Malicious Files"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "http://git.drupalcode.org/project/filefield_paths", "vendor": "Drupal", "product": "Drupal File (Field) Paths", "versions": [{"status": "affected", "version": "7.x-1.0", "lessThan": "7.x-1.3", "versionType": "custom"}], "platforms": ["Drupal 7.x"], "packageName": "File (Field) Paths", "collectionURL": "https://www.drupal.org/project/filefield_paths", "defaultStatus": "unaffected"}], "references": [{"url": "https://www.herodevs.com/vulnerability-directory/cve-2026-1556", "tags": ["third-party-advisory"]}, {"url": "https://d7es.tag1.com/security-advisories/file-field-paths-moderately-critical-file-path-manipulation", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Information disclosure in the file URI processing of File (Field) Paths in Drupal File (Field) Paths 7.x prior to 7.1.3 on Drupal 7.x allows authenticated users to disclose other users\u2019 private files via filename\u2011collision uploads. This can cause hook_node_insert() consumers (for example, email attachment modules) to receive the wrong file URI, bypassing normal access controls on private files.", "supportingMedia": [{"type": "text/html", "value": "Information disclosure in the file URI processing of File (Field) Paths in Drupal File (Field) Paths 7.x prior to 7.1.3 on Drupal 7.x allows authenticated users to disclose other users\u2019 private files via filename\u2011collision uploads. This can cause hook_node_insert() consumers (for example, email attachment modules) to receive the wrong file URI, bypassing normal access controls on private files.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2026-03-26T21:14:20.549Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1556", "state": "PUBLISHED", "dateUpdated": "2026-03-27T19:39:20.961Z", "dateReserved": "2026-01-28T17:20:34.800Z", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "datePublished": "2026-03-26T21:14:20.549Z", "assignerShortName": "drupal"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://www.drupal.org/project/filefield_paths", "defaultStatus": "unaffected", "packageName": "File (Field) Paths", "platforms": ["Drupal 7.x"], "product": "Drupal File (Field) Paths", "repo": "http://git.drupalcode.org/project/filefield_paths", "vendor": "Drupal", "versions": [{"lessThan": "7.x-1.3", "status": "affected", "version": "7.x-1.0", "versionType": "custom"}]}], "source": "mlhess@drupal.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:deciphered:filefield_paths:*:*:*:*:*:drupal:*:*", "matchCriteriaId": "FD9688B8-4C6B-4E8F-8C39-8D46941E9A01", "versionEndExcluding": "7.x-1.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Information disclosure in the file URI processing of File (Field) Paths in Drupal File (Field) Paths 7.x prior to 7.1.3 on Drupal 7.x allows authenticated users to disclose other users\u2019 private files via filename\u2011collision uploads. This can cause hook_node_insert() consumers (for example, email attachment modules) to receive the wrong file URI, bypassing normal access controls on private files."}, {"lang": "es", "value": "Revelaci\u00f3n de informaci\u00f3n en el procesamiento de URI de archivo de Rutas de Archivo (Campo) en Drupal File (Field) Paths 7.x anterior a 7.1.3 en Drupal 7.x permite a usuarios autenticados revelar archivos privados de otros usuarios mediante cargas por colisi\u00f3n de nombres de archivo. Esto puede causar que consumidores de hook_node_insert() (por ejemplo, m\u00f3dulos de adjuntos de correo electr\u00f3nico) reciban la URI de archivo incorrecta, eludiendo los controles de acceso normales en archivos privados."}], "id": "CVE-2026-1556", "lastModified": "2026-06-17T10:16:04.010", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "mlhess@drupal.org", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1556", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-27T19:28:14.455549Z", "version": "2.0.3"}}]}, "published": "2026-03-26T22:16:27.843", "references": [{"source": "mlhess@drupal.org", "tags": ["Third Party Advisory"], "url": "https://d7es.tag1.com/security-advisories/file-field-paths-moderately-critical-file-path-manipulation"}, {"source": "mlhess@drupal.org", "tags": ["Exploit", "Mitigation", "Third Party Advisory"], "url": "https://www.herodevs.com/vulnerability-directory/cve-2026-1556"}], "sourceIdentifier": "mlhess@drupal.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "mlhess@drupal.org", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "Drupal: File (Field) Paths: Drupal File (Field) Paths: Information Disclosure via filename-collision uploads", "id": "2451981", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451981"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.7", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-73", "details": ["A flaw was found in Drupal File (Field) Paths. This information disclosure vulnerability allows authenticated users to disclose other users\u2019 private files. This can be exploited by performing filename-collision uploads, which causes the system to receive incorrect file Uniform Resource Identifiers (URIs), thereby bypassing normal access controls on private files."], "name": "CVE-2026-1556", "public_date": "2026-03-26T21:14:20Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-1556\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-1556\nhttps://d7es.tag1.com/security-advisories/file-field-paths-moderately-critical-file-path-manipulation\nhttps://www.herodevs.com/vulnerability-directory/cve-2026-1556"], "statement": "This information disclosure vulnerability in Drupal File (Field) Paths allows authenticated users to access private files belonging to other users. The flaw arises from filename-collision uploads, which can cause the system to process incorrect file URIs and bypass normal access controls on private files within Drupal 7.x installations utilizing the affected module.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": ["drupal_7.x"], "status": "affected", "versions": {"scheme": "generic", "value": "[7.x-1.0,7.x-1.3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Drupal File (Field) Paths", "source": "cna", "vendor": "Drupal"}, "product": "drupal_file_paths", "vendor": "drupal"}], "analysis": {"en": {"generated_at": "2026-04-02T21:49:35.588237+00:00", "value": {"mitigation_remediation": ["Upgrade Drupal to version 7.1.3 or later", "Restrict file upload permissions for authenticated users to prevent filename collisions", "Monitor file upload logs for unusual activity and potential collisions", "Consult Drupal security advisories for additional protection measures"], "summary": {"action": "Apply Patch", "impact": "Information Disclosure"}, "threat_synthesis": {"affected_systems": "Drupal systems running the File (Field) Paths module before version 7.1.3 are affected. The vulnerability exists in Drupal 7.x, specifically in the File (Field) Paths component shipped with versions older than 7.1.3.", "description_and_impact": "Authenticated users can upload files with names that collide with existing private file names, causing the system to overwrite or expose the private file URI. This flaw allows the attacker to obtain the contents of another user\u2019s private files, violating confidentiality and bypassing normal access controls on private resources. The weakness is a file name collision in the file URI processing logic, leading to inadequate checks before exposure.", "risk_and_exploitability": "The CVSS score of 6.9 indicates moderate severity. The EPSS score of less than 1% suggests a low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated to trigger the collision; the attack vector is a standard file upload via authenticated users. Once executed, it can expose private files without further interaction, but does not provide privilege escalation or code execution."}}}}, "created": "2026-03-27T08:31:46.592391+00:00", "updated": "2026-04-03T09:38:48.267865+00:00", "vendors": ["drupal", "drupal$PRODUCT$drupal_file_paths"]}