Drupal File Field Paths CVE-2026-1556

This vulnerability requires authenticated access (PR:L per the description stating 'authenticated users'), reducing the attack surface compared to unauthenticated exploits. The CVSS score and vector data are unavailable in the provided intelligence, preventing formal risk quantification; however, the CWE-200 classification and the impact on access control bypass indicate moderate to significant real-world risk. The exploitation mechanism depends on filename-collision conditions and the presence of hook_node_insert() consumers in the target environment, which introduces some complexity into exploitation. No EPSS score, KEV status, or public exploit code is documented in available sources, suggesting this is not yet actively exploited at scale or widely weaponized. The risk is highest in Drupal environments where File (Field) Paths is actively used in conjunction with email attachment modules or other sensitive file-handling integrations. Organizations running versions prior to 7.1.3 should prioritize patching to eliminate the vulnerability, but the requirement for authentication and the specific configuration dependencies limit the immediate urgency compared to unauthenticated remote code execution flaws.

An authenticated attacker creates a user account on a Drupal 7.x site running File (Field) Paths prior to 7.1.3. The attacker uploads a file with a specific filename designed to collide with a filename recently uploaded by another user to a private file directory. Due to the file URI collision vulnerability, when a hook_node_insert() consumer (such as an email notification module) processes the node creation, it receives and processes the incorrect file URI pointing to the target user's private file instead of the attacker's file. If the email module attaches files based on URI without re-validating access permissions, the private file is disclosed or attached to an email, exposing sensitive information such as confidential documents or personal data that should only be accessible to the file owner.