Drupal Blazy CVE-2026-81165

Exploitation requires the target Drupal site to have the Blazy module installed and enabled at a version prior to 3.0.18, and for the site to host media or file content that is intended to be access-restricted to specific roles or authenticated users. The attacker must be able to reach the site over the network and must know or enumerate a valid URL for a restricted asset. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms no authentication is required. Exploitation is not meaningful against sites where all served media is already publicly accessible by design. There is no evidence that a non-default configuration is required beyond the vulnerable module being active.

The CVSS 5.3 (Medium) vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N accurately characterizes a remotely exploitable but scope-limited flaw - unauthenticated network access is sufficient, but the attacker gains only low confidentiality exposure and no write or availability impact. No EPSS score was included in the available intelligence, so exploitation probability cannot be quantified. This CVE is absent from the CISA KEV catalog, and no public proof-of-concept code has been identified, indicating no confirmed active exploitation at time of analysis. A practical limiting factor is that forceful browsing requires the attacker to know or enumerate the exact URLs of restricted assets, which raises de-facto complexity beyond the AC:L vector metric. Real-world risk is elevated for Drupal deployments hosting access-gated documents, images, or media (e.g., subscriber-only content, internal portals), but negligible for sites where all media is intentionally public. Overall this is a genuine patch-now issue for affected deployments with sensitive content, but not a critical-urgency flaw for general installations.

An unauthenticated attacker enumerates or guesses the direct URL of a media file - such as a member-only PDF or a private image - managed through the Blazy module, then issues a plain HTTP GET request to that URL. Because Blazy fails to enforce Drupal's access checks on lazily-loaded asset paths, the server returns the restricted file without requiring any session or credential. No exploit tooling or proof-of-concept code has been identified; the attack is achievable with a standard web browser or curl.