CVE-2026-1556

Katalog CVE

CVSS 6.5 · Medium EPSS 0,39%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada deciphered filefield paths. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

Information disclosure in the file URI processing of File (Field) Paths in Drupal File (Field) Paths 7.x prior to 7.1.3 on Drupal 7.x allows authenticated users to disclose other users’ private files via filename‑collision uploads. This can cause hook_node_insert() consumers (for example, email attachment modules) to receive the wrong file URI, bypassing normal access controls on private files.

Rincian

Terbit di NVD

26 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

EPSS (30 hari)

0,39% peluang dieksploitasi; lebih tinggi dari 31,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.herodevs.com/vulnerability-directory/cve-2026-1556 exploit · mitigasi · advisory pihak ketiga
• https://d7es.tag1.com/security-advisories/file-field-paths-moderately-critical-file-path-manipulation advisory pihak ketiga