Medium severity · published Mar 26, 2026
CVE-2026-1556
Information disclosure via file URI overwrite in File (Field) Paths
6.5
CVSS
0.4%
EPSS
No
On KEV
Description
Information disclosure in the file URI processing of File (Field) Paths in Drupal File (Field) Paths 7.x prior to 7.1.3 on Drupal 7.x allows authenticated users to disclose other users’ private files via filename‑collision uploads. This can cause hook_node_insert() consumers (for example, email attachment modules) to receive the wrong file URI, bypassing normal access controls on private files.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DR
Drupal · Drupal
7.x-1.0 before 7.x-1.3 · source: vendor
FP
Filefield Paths · Deciphered
before 7.x-1.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-1556
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-1556
Third Party Advisory
https://d7es.tag1.com/security-advisories/file-field-paths-moderately-critical-file-path-manipulation
Exploit
https://www.herodevs.com/vulnerability-directory/cve-2026-1556
More from Drupal
9.8
CVE-2026-9082
Drupal core - Highly critical - SQL injection - SA-CORE-2026-004
9.8
CVE-2018-7602
Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-004
9.8
CVE-2018-7600
Drupal Core Remote Code Execution Vulnerability
8.8
CVE-2020-13671
Drupal core Un-restricted Upload of File
8.1
CVE-2019-6340
Drupal core - Highly critical - Remote Code Execution