Authenticated users can upload files with names that collide with existing private file names, causing the system to overwrite or expose the private file URI. This flaw allows the attacker to obtain the contents of another user’s private files, violating confidentiality and bypassing normal access controls on private resources. The weakness is a file name collision in the file URI processing logic, leading to inadequate checks before exposure.

Drupal systems running the File (Field) Paths module before version 7.1.3 are affected. The vulnerability exists in Drupal 7.x, specifically in the File (Field) Paths component shipped with versions older than 7.1.3.

The CVSS score of 6.9 indicates moderate severity. The EPSS score of less than 1% suggests a low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated to trigger the collision; the attack vector is a standard file upload via authenticated users. Once executed, it can expose private files without further interaction, but does not provide privilege escalation or code execution.