CVE-2026-114554
AI File to Text - Moderately critical - Access bypass - SA-CONTRIB-2026-251
Incorrect Authorization vulnerability in Drupal AI File to Text allows Forceful Browsing. This issue affects AI File to Text versions: from 0.0.0 to 1.0.1.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
AI File to Text - Moderately critical - Access bypass - SA-CONTRIB-2026-251
Incorrect Authorization vulnerability in Drupal AI File to Text allows Forceful Browsing. This issue affects AI File to Text versions: from 0.0.0 to 1.0.1.
- Record
CVE-2026-114554- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-863
- Updated
- 2026-11-06
EUVDEUVD-2026-113521
Incorrect Authorization vulnerability in Drupal AI File to Text allows Forceful Browsing. This issue affects AI File to Text versions: from 0.0.0 to 1.0.1.
- Record
EUVD-2026-113521- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-06
GitHub AdvisoriesGHSA-8cj5-9925-mw98
Incorrect Authorization vulnerability in Drupal AI File to Text allows Forceful Browsing. This...
Incorrect Authorization vulnerability in Drupal AI File to Text allows Forceful Browsing. This issue affects AI File to Text versions: from 0.0.0 to 1.0.1.
- Record
GHSA-8cj5-9925-mw98- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-863
- Updated
- 2026-11-06
NVD
Incorrect Authorization vulnerability in Drupal AI File to Text allows Forceful Browsing. This issue affects AI File to Text versions: from 0.0.0 to 1.0.1.
- Record
CVE-2026-114554- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-863
- Updated
- 2026-11-06
OSV
AI File to Text - Moderately critical - Access bypass - SA-CONTRIB-2026-251
Incorrect Authorization vulnerability in Drupal AI File to Text allows Forceful Browsing. This issue affects AI File to Text versions: from 0.0.0 to 1.0.1.
- Record
CVE-2026-114554- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-863
- Updated
- 2026-11-07
OSVDRUPAL-CONTRIB-2026-251 No score
The AI File to Text module extracts text from uploaded documents, including
Word, PDF, OpenDocument, CSV, Markdown and plain text files, and exposes that extraction to AI agents and automators as a tool.
The module does not sufficiently check whether the current user is permitted
to view a file before extracting its contents. This allows the contents of files the user could not otherwise download, including files held in the private file system,
to be disclosed.
This vulnerability is mitigated by the fact that an attacker must have a role
with permission to invoke AI tools, for example through an agent or the AI API
Explorer.
- Record
DRUPAL-CONTRIB-2026-251- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal/ai_file_to_textPackagist:https://packages.drupal.org/8 |
before 1.0.1 | 1.0.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| severity | CVE List | |
| facts, severity | EUVD | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-114554 is a medium vulnerability (CVSS 4.3) in Drupal Ai File To Text, published October 21, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.20%, the 9th percentile. Fixed in drupal/ai_file_to_text 1.0.1.