CVE-2026-1556

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Information disclosure in the file URI processing of File (Field) Paths in Drupal File (Field) Paths 7.x prior to 7.1.3 on Drupal 7.x allows authenticated users to disclose other users’ private files via filename‑collision uploads. This can cause hook_node_insert() consumers (for example, email attachment modules) to receive the wrong file URI, bypassing normal access controls on private files.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

VendorProductVersions
DrupalDrupal File (Field) Paths>= 7.x-1.0, < 7.x-1.3

References

Timeline

Published
Mar 26, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-155608.1when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, alCVE-2026-155617.5A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder. missing limits on size and count would allow an attacker to use an unaCVE-2026-155627.5A flaw was found in EAP's jboss-remoting. A remote unauthenticated attacker who can reach :8080 (or :9990, or :4447) and complete an UpgradeCVE-2026-155637.4A flaw was found in EAP's IIOP. The listener's NameService would accept bind operations without authentication, allowing an attacker to hijaCVE-2026-155647.4Wildfly's IIOP listener may permit deserialization of input streams before authentication is performed. An attacker who can gain access to tCVE-2026-155657.5A flaw was found in Undertow. A remote attacker can cause Out of Memory on websockets endpoint without authentication on any @ServerEndpointCVE-2026-155677.5A flaw was found in Wildfly. A remote unauthenticated attacker can trigger OutOfMemoryError as CSIv2Util's GSS token decoder reads an attackCVE-2026-15577.5The WP Responsive Images plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.0 via the 'src' parameCVE-2026-155707.1An improper restriction of URL schemes and destinations in the SmartCenter browserseturl command in the Telefunken TE24553B45V2DZ Smart TV rCVE-2026-155717.3A flaw was found in the legacy client-initiated account-linking endpoint of Keycloak, a widely used open-source identity and access managemeCVE-2026-155728.8A flaw was found in Keycloak's Dynamic Client Registration (DCR) security policy management. The "Allowed Protocol Mapper Types" policy, whiCVE-2026-155738.1A flaw was found in Keycloak's Authorization Services. The component responsible for matching request paths to security policies (PathMatche
CVE-2026-1556: Medium severity, CVSS 6.5 | Vulnix