File Access Fix Deprecated CVE-2026-3525

Real-world risk is moderate despite the absence of a CVSS score and vector data. The vulnerability's attack vector is remote with low complexity-authorization bypass flaws in file access are typically straightforward to exploit once the endpoint is discovered, requiring minimal technical sophistication. The lack of a public exploit code and confirmed active exploitation (KEV status not present) reduces immediate threat severity, but the deprecated status of the affected module and the fundamental nature of authorization flaws mean this remains a legitimate priority for any organization still maintaining this code. The ENISA EUVD ID (EUVD-2026-16375) assignment confirms formal recognition of the vulnerability. Organizations should prioritize this based on their dependency inventory: if the File Access Fix module is present in production, remediation is essential; if already removed or replaced, risk is eliminated. The absence of CVSS and EPSS data limits quantitative risk modeling, but the authorization bypass classification inherently carries elevated risk in file-serving contexts.

An unauthenticated attacker discovers the Drupal installation hosts the File Access Fix (deprecated) module and performs path enumeration against the file serving endpoints (e.g., /sites/default/files/). By systematically requesting file paths with varying names or using common file patterns, the attacker bypasses the broken authorization checks and retrieves sensitive files-such as configuration backups, database exports, or private user documents-without providing valid Drupal user credentials. The low complexity and remote nature of the attack make this exploitable with basic HTTP tools.