Drupal File (Field) Paths
Approved changes feed: RSS · Atom
cpe:2.3:a:drupal:drupal_file_(field)_paths:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Drupal (5a354f1f-83c2-5c0e-b1bc-3ae1f55812de) |
|---|---|
| Product | Drupal File (Field) Paths (2b16aed6-4512-562a-979d-ca8954fa7588) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-1556 |
vulnerable | 2026-06-08 07:49:08.883100 |
Information disclosure via file URI overwrite in File (Field) Paths
Information disclosure in the file URI processing of File (Field) Paths in Drupal File (Field) Paths 7.x prior to 7.1.3 on Drupal 7.x allows authenticated users to disclose other users’ private files via filename‑collision uploads. This can cause hook_node_insert() consumers (for example, email attachment modules) to receive the wrong file URI, bypassing normal access controls on private files.
Published: 2026-03-26T21:14:20.549Z
Updated: 2026-03-27T19:39:20.961Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.