Deciphered

deciphered

1 CVE • 1 product

Products (1)

Click to collapse

Toggle

Filefield Paths

filefield_paths

1 CVE

CVEs (1)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2026-1556 1Deciphered 1Filefield Paths Jun 17, 2026 Mar 26, 2026 6.9 MEDIUM· v4 6.5 MEDIUM· v3 N/A· v2 Information disclosure in the file URI processing of File (Field) Paths in Drupal File (Field) Paths 7.x prior to 7.1.3 on Drupal 7.x allows authenticated users to disclose other users’ private files via filename‑collisi...Show more Information disclosure in the file URI processing of File (Field) Paths in Drupal File (Field) Paths 7.x prior to 7.1.3 on Drupal 7.x allows authenticated users to disclose other users’ private files via filename‑collision uploads. This can cause hook_node_insert() consumers (for example, email attachment modules) to receive the wrong file URI, bypassing normal access controls on private files.Show less

CVE

VENDORS

PRODUCTS

UPDATED

PUBLISHED

CVSS

CVE-2026-1556

1Deciphered

1Filefield Paths

Jun 17, 2026

Mar 26, 2026

6.9 MEDIUM· v4

6.5 MEDIUM· v3

N/A· v2

Information disclosure in the file URI processing of File (Field) Paths in Drupal File (Field) Paths 7.x prior to 7.1.3 on Drupal 7.x allows authenticated users to disclose other users’ private files via filename‑collision uploads. This can cause hook_node_insert() consumers (for example, email attachment modules) to receive the wrong file URI, bypassing normal access controls on private files.Show less