Overview
The File (Field) Paths module for Drupal 7.x has a security flaw that could lead to sensitive information being exposed. This vulnerability, identified as CVE-2026-1556, allows authenticated users to access other users’ private files. This happens because the module mishandles file paths when files are moved, creating a situation where old, incorrect file locations are still referenced. This can trick systems that use these file paths, like modules for email attachments, into sending or displaying the wrong, private files, effectively bypassing normal security checks.
CVE Details
The vulnerability affects the File (Field) Paths module for Drupal 7.x.
- Published Date: February 26, 2026
- Severity: Medium (CVSS Score: 6.5)
- Status: Analyzed
This issue specifically involves a “File Path Manipulation via Inconsistent File URI State,” where the module fails to properly update file URIs after move operations.
Affected Products
This vulnerability impacts sites using the **File (Field) Paths module for Drupal 7.x** in versions prior to **7.x-1.3**. If your Drupal 7.x installation utilizes this module for automatically organizing uploaded files, you are likely affected. The risk is somewhat lessened because administrative privileges are needed to upload files and configure file paths, and it only applies to sites actively using the module’s automatic file organization features.
Current Status
The vulnerability has been thoroughly **Analyzed**, and details regarding its nature and potential impact are now public.
Severity Level
CVE-2026-1556 is rated as **Medium** severity with a CVSS score of 6.5. The Drupal security advisory describes it as “Moderately Critical.” A Medium severity rating indicates that while the vulnerability could have a noticeable impact, it might require specific conditions or user interaction to be exploited. In this case, it primarily affects the confidentiality of private files by allowing their unauthorized disclosure under certain circumstances related to file handling.
Possible Solutions
The most important step to protect your Drupal 7.x website from this information disclosure vulnerability is to update the File (Field) Paths module.
You should upgrade your File (Field) Paths module to version **7.x-1.3** or later. This updated version addresses the inconsistencies in file URI states that cause the vulnerability.
You can typically find the updated module directly on the Drupal project page or through official releases. For convenience, the advisory mentioned specific download links for version 7.x-1.3:
- filefield_paths-7.x-1.3.tar.gz
- filefield_paths-7.x-1.3.zip
Regularly updating your modules and Drupal core is a critical practice for maintaining the security of your website.
References
https://d7es.tag1.com/security-advisories/file-field-paths-moderately-critical-file-path-manipulation
https://www.herodevs.com/vulnerability-directory/cve-2026-1556
