CVE-2026-1556 Information disclosure via file URI overwrite in File (Field) Paths
Authenticated users can disclose private files by exploiting filename collisions in file URI processing, bypassing access controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-1556?
CVE-2026-1556 is a medium-severity vulnerability in Drupal File (Field) Paths, published on 26 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Information disclosure in the file URI processing of File (Field) Paths in Drupal File (Field) Paths 7.x prior to 7.1.3 on Drupal 7.x allows authenticated users to disclose other users’ private files via filename‑collision uploads. This can cause hook_node_insert() consumers (for example, email attachment modules) to receive the wrong file URI, bypassing normal access controls on private files.
Weakness: CWE-200
Which versions are affected by CVE-2026-1556?
It affects 1 product.
Products include Deciphered Filefield Paths.
How do I fix CVE-2026-1556?
Upgrade to a fixed version.
Is CVE-2026-1556 being exploited?
There is no known exploitation of CVE-2026-1556 in the wild and no public exploit code.
Sources
Also known as CLSA-2026-1789633080, GHSA-rfjg-8j24-w8q7, UBUNTU-CVE-2026-1556.