CVE-2026-1556

Information disclosure in the file URI processing of File (Field) Paths in Drupal File (Field) Paths 7.x prior to 7.1.3 on Drupal 7.x allows authenticated users to disclose other users’ private files via filename‑collision uploads. This can cause hook_node_insert() consumers (for example, email attachment modules) to receive the wrong file URI, bypassing normal access controls on private files.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://d7es.tag1.com/security-advisories/file-field-paths-moderately-critical-file-path-manipulation	Third Party Advisory
https://www.herodevs.com/vulnerability-directory/cve-2026-1556	Exploit Mitigation Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:deciphered:filefield_paths:*:*:*:*:*:drupal:*:*

History

No history.

Information

Published : 2026-03-26 22:16

Updated : 2026-06-17 10:16

NVD link : CVE-2026-1556

Mitre link : CVE-2026-1556

CVE.ORG link : CVE-2026-1556

JSON object : View

Products Affected

deciphered

filefield_paths

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

NVD-CWE-noinfo

{"id": "CVE-2026-1556", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1556", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-27T19:28:14.455549Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "mlhess@drupal.org", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "mlhess@drupal.org", "affectedData": [{"repo": "http://git.drupalcode.org/project/filefield_paths", "vendor": "Drupal", "product": "Drupal File (Field) Paths", "versions": [{"status": "affected", "version": "7.x-1.0", "lessThan": "7.x-1.3", "versionType": "custom"}], "platforms": ["Drupal 7.x"], "packageName": "File (Field) Paths", "collectionURL": "https://www.drupal.org/project/filefield_paths", "defaultStatus": "unaffected"}]}], "published": "2026-03-26T22:16:27.843", "references": [{"url": "https://d7es.tag1.com/security-advisories/file-field-paths-moderately-critical-file-path-manipulation", "tags": ["Third Party Advisory"], "source": "mlhess@drupal.org"}, {"url": "https://www.herodevs.com/vulnerability-directory/cve-2026-1556", "tags": ["Exploit", "Mitigation", "Third Party Advisory"], "source": "mlhess@drupal.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "mlhess@drupal.org", "description": [{"lang": "en", "value": "CWE-200"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Information disclosure in the file URI processing of File (Field) Paths in Drupal File (Field) Paths 7.x prior to 7.1.3 on Drupal 7.x allows authenticated users to disclose other users\u2019 private files via filename\u2011collision uploads. This can cause hook_node_insert() consumers (for example, email attachment modules) to receive the wrong file URI, bypassing normal access controls on private files."}, {"lang": "es", "value": "Revelaci\u00f3n de informaci\u00f3n en el procesamiento de URI de archivo de Rutas de Archivo (Campo) en Drupal File (Field) Paths 7.x anterior a 7.1.3 en Drupal 7.x permite a usuarios autenticados revelar archivos privados de otros usuarios mediante cargas por colisi\u00f3n de nombres de archivo. Esto puede causar que consumidores de hook_node_insert() (por ejemplo, m\u00f3dulos de adjuntos de correo electr\u00f3nico) reciban la URI de archivo incorrecta, eludiendo los controles de acceso normales en archivos privados."}], "lastModified": "2026-06-17T10:16:04.010", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:deciphered:filefield_paths:*:*:*:*:*:drupal:*:*", "vulnerable": true, "matchCriteriaId": "FD9688B8-4C6B-4E8F-8C39-8D46941E9A01", "versionEndExcluding": "7.x-1.3"}], "operator": "OR"}]}], "sourceIdentifier": "mlhess@drupal.org"}