CVE-2026-3526
CVE-2026-3526 · File Access Fix (deprecated) - Moderately critical - Access bypass - SA-CONTRIB-2026-021
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Incorrect Authorization vulnerability in Drupal File Access Fix (deprecated) allows Forceful Browsing.This issue affects File Access Fix (deprecated): from 0.0.0 before 1.2.0.
CVSS 5.3 · Medium · EPSS 0.3% · Fix available
- Published
- Updated
Stack: php
Affected products and versions
file access fix (deprecated)
- Versions
- ≥ 0.0.0, < 1.2.0: Affected (semver)
Update to 1.2.0
drupal/file_access_fix Packagist:https://packages.drupal.org/8
- Affected ranges
- ECOSYSTEM: < 1.2.0
Update to 1.2.0