DRUPAL-CONTRIB-2026-251

The AI File to Text module extracts text from uploaded documents, including Word, PDF, OpenDocument, CSV, Markdown and plain text files, and exposes that extraction to AI agents and automators as a tool. The module does not sufficiently check whether the current user is permitted to view a file...

AI File to Text - Moderately critical - Access bypass - SA-CONTRIB-2026-251

The AI File to Text module extracts text from uploaded documents, including Word, PDF, OpenDocument, CSV, Markdown and plain text files, and exposes that extraction to AI agents and automators as a tool. The module does not sufficiently check whether the current user is permitted to view a file...

PT-2026-120922

The AI File to Text module extracts text from uploaded documents, including Word, PDF, OpenDocument, CSV, Markdown and plain text files, and exposes that extraction to AI agents and automators as a tool. The module does not sufficiently check whether the current user is permitted to view a file...

CVE-2026-105631

The open-source project management tool Plane is vulnerable to unauthorized data disclosure in versions prior to 1.4.0 . The WorkspaceFileAssetEndpoint.get and WorkspaceAssetDownloadEndpoint.get endpoints fail to verify if a user has membership in the specific project containing a FileAsset recor...

CVE-2026-105631 Plane: asset download endpoints scope file lookups to the workspace (not the project / published entity) → cross-project & unauthenticated private-file disclosure

Plane is an open-source project management tool. Prior to 1.4.0, WorkspaceFileAssetEndpoint.get and WorkspaceAssetDownloadEndpoint.get resolve FileAsset records within a workspace without checking membership in the asset's project, allowing a workspace member to download assets from private...

CVE-2026-105631 Plane: asset download endpoints scope file lookups to the workspace (not the project / published entity) → cross-project & unauthenticated private-file disclosure

Plane is an open-source project management tool. Prior to 1.4.0, WorkspaceFileAssetEndpoint.get and WorkspaceAssetDownloadEndpoint.get resolve FileAsset records within a workspace without checking membership in the asset's project, allowing a workspace member to download assets from private...

CVE-2026-105631 Plane: asset download endpoints scope file lookups to the workspace (not the project / published entity) → cross-project & unauthenticated private-file disclosure

Plane is an open-source project management tool. Prior to 1.4.0, WorkspaceFileAssetEndpoint.get and WorkspaceAssetDownloadEndpoint.get resolve FileAsset records within a workspace without checking membership in the asset's project, allowing a workspace member to download assets from private...

CVE-2026-97332 User Private Files < 2.2.0 - Unauthenticated Private File Disclosure via .htaccess Rewrite Rule Bypass (Multisite)

The User Private Files WordPress plugin before 2.2.0 does not properly protect its stored private files on multisite installations, where the rewrite rule it relies on to route file requests through its access check is never reached, allowing unauthenticated users to retrieve other users' private...

CVE-2026-97332 User Private Files < 2.2.0 - Unauthenticated Private File Disclosure via .htaccess Rewrite Rule Bypass (Multisite)

The User Private Files WordPress plugin before 2.2.0 does not properly protect its stored private files on multisite installations, where the rewrite rule it relies on to route file requests through its access check is never reached, allowing unauthenticated users to retrieve other users' private...

WordPress User Private Files plugin < 2.2.0 - Unauthenticated Private File Disclosure vulnerability

Unauthenticated Private File Disclosure vulnerability discovered by Akshat Parikh SN1PER in WordPress Plugin User Private Files versions 2.2.0...

CVE-2026-97332

The User Private Files WordPress plugin, in versions before 2.2.0 , is vulnerable to unauthenticated private file disclosure on multisite installations. The root cause is a rewrite rule bypass where requests to stored private files do not route through the plugin's required access check. This all...

CVE-2026-28603

In assertSafeToStartCustomActivity of AppRestrictionsFragment.java, there is a possible read/write access to private files due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28603

A confused deputy vulnerability in the assertSafeToStartCustomActivity function of AppRestrictionsFragment.java allows for read/write access to private files. This flaw could enable local escalation of privilege without requiring additional execution privileges or user interaction. Security updat...

CVE-2026-28603

In assertSafeToStartCustomActivity of AppRestrictionsFragment.java, there is a possible read/write access to private files due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

EUVD-2026-73956

In assertSafeToStartCustomActivity of AppRestrictionsFragment.java, there is a possible read/write access to private files due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28603

In assertSafeToStartCustomActivity of AppRestrictionsFragment.java, there is a possible read/write access to private files due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28603: Unintended Proxy or Intermediary

In assertSafeToStartCustomActivity of AppRestrictionsFragment.java, there is a possible read/write access to private files due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-85693

Chatbot UI (open-source chat application) contains an authorization bypass in its retrieval endpoint (/api/retrieval/retrieve). The root cause is a service-role Supabase client that bypasses row-level security and fails to validate file ownership, allowing any authenticated user to retrieve index...

CVE-2026-85693: Authorization Bypass Through User-Controlled Key

Chatbot UI contains an authorization bypass vulnerability in the retrieval endpoint that allows authenticated attackers to access private file content belonging to other users by supplying arbitrary file UUIDs. The endpoint uses a service-role Supabase client that bypasses row-level security and...

Media Library Importer - Moderately critical - Access bypass - SA-CONTRIB-2026-129

A module to import media files into media library. The import folder is a plain textfield with no validation. Point it at any directory the web user can read, and the importer copies every file whose extension matches a selected media type into the public files directory and publishes it as a Med...