CVE-2026-114554

Name of the Vulnerable Software and Affected Versions Drupal AI File to Text versions 0.0.0 through 1.0.1

Description An incorrect authorization issue allows forceful browsing within the AI File to Text module, which extracts text from documents such as Word, PDF, OpenDocument, CSV, Markdown, and plain text files for AI agents. The module fails to sufficiently verify if the current user has permission to view a file before extracting its contents, potentially disclosing files from the private file system that the user is not authorized to download. Exploitation requires the attacker to possess a role with permissions to invoke AI tools, such as through an agent or the AI API Explorer.

Recommendations Update Drupal AI File to Text to a version newer than 1.0.1.