CVE-2026-118551

Name of the Vulnerable Software and Affected Versions Drupal AI versions 0.0.0 through 1.4.11 Drupal AI versions 1.5.0 through 1.5.2

Description Insecure storage of sensitive information occurs when audio files for speech-to-text requests are written to a single file in the temporary directory and are not deleted after processing. This allows an attacker with read access to the site's temporary directory—potentially via shared hosting or other code exposing temporary files—to retrieve audio data sent by other users for transcription.

Recommendations Update Drupal AI versions 0.0.0 through 1.4.11 to a version newer than 1.4.11. Update Drupal AI versions 1.5.0 through 1.5.2 to a version newer than 1.5.2.