CVE-2026-114554 Drupal CVE debrief

Who should care

Drupal site administrators, users with AI tool permissions, and security teams responsible for monitoring and patching Drupal installations should verify exposure and apply patches to prevent potential exploitation. These stakeholders should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Why it matters

CVE-2026-114554 is a vulnerability in the AI File to Text module for Drupal that allows unauthorized file disclosure. Site administrators and users with AI tool permissions should verify exposure and apply patches to prevent potential exploitation.

• Potential unauthorized disclosure of private file contents.
• Possible exploitation by users with AI tool invocation permissions.
• Need for verification of module installation, user roles, and permission settings.
• Requirement for patching or updating to version 1.0.1 or later.

Technical summary

The AI File to Text module for Drupal does not properly check user permissions before extracting contents from uploaded files, potentially allowing users with AI tool invocation permissions to access private file contents. This vulnerability is mitigated by the fact that an attacker must have a role with permission to invoke AI tools. The module extracts text from uploaded documents, including Word, PDF, OpenDocument, CSV, Markdown and plain text files, and exposes that extraction to AI agents and automators as a tool.

Defensive priority

Drupal site administrators and users with AI tool permissions should verify exposure and apply patches.

Recommended defensive actions

• Verify if the AI File to Text module is installed and enabled on your Drupal site.
• Check if your Drupal site has users with roles permitted to invoke AI tools.
• Apply the patch or update to version 1.0.1 or later if vulnerable.
• Monitor file access and AI tool usage for suspicious activity.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The AI File to Text module does not sufficiently check user permissions before extracting file contents, potentially disclosing private file contents. This issue is exacerbated by the fact that an attacker must have a role with permission to invoke AI tools. The vulnerability allows the contents of files the user could not otherwise download, including files held in the private file system, to be disclosed. Evidence is based on the supplied source corpus and CVE record.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.