Red Hat CVE-2026-1556

Drupal File (Field) Paths is a module that manages file field path generation and URI processing for Drupal 7.x installations. The vulnerability exists in the file URI processing logic when handling field paths, specifically in how the module resolves and assigns file URIs during node insertion operations. The root cause is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), indicating insufficient access control validation when processing file paths. The vulnerability exploits a filename-collision condition where two authenticated users uploading files with identical or specially-crafted names can trigger URI assignment confusion, causing the system to associate the wrong file URI with a given file operation. This is particularly dangerous because hook_node_insert() implementations-common in email attachment and file processing modules-consume the potentially incorrect file URI without re-validating access permissions against the private file's actual owner.