PT-2026-28313 · Drupal · Drupal File (Field) Paths

Michael Hess · Published 2026-03-26 · Updated 2026-03-26 · CVE-2026-1556

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Drupal File (Field) Paths versions prior to 7.1.3

Description An information disclosure issue exists in the file URI processing of File (Field) Paths in Drupal. Authenticated users can potentially disclose other users’ private files through filename-collision uploads. This can occur when consumers of hook node insert()—such as email attachment modules—receive an incorrect file URI, bypassing normal access controls on private files.

Recommendations Update Drupal File (Field) Paths to version 7.1.3 or later.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-1556

Affected Products

Drupal File (Field) Paths

References · 7

• 🔥 https://herodevs.com/vulnerability-directory/cve-2026-1556 · Exploit
• https://ubuntu.com/security/CVE-2026-1556 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-1556 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-1556 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-1556 · Security Note
• https://d7es.tag1.com/security-advisories/file-field-paths-moderately-critical-file-path-manipulation · Note
• https://twitter.com/CVEnew/status/2037280516035268637 · Twitter Post