{"id":"DRUPAL-CONTRIB-2026-271","details":"This module provides a framework for integrating AI providers and features into Drupal.\n\nAudio for every speech-to-text request is written to the same file in the temporary directory and does not delete it afterwards. As a result, an attacker who can read the site's temporary directory could get the audio that another user sent for transcription.\n\nThis vulnerability is mitigated by the fact that the attacker needs read access to the temporary directory, either through the server (for example a shared hosting account) or through a module or custom code that exposes temporary files to other users. Drupal core's `system.temporary` route only serves temporary files to the user who owns them.","aliases":["CVE-2026-118551"],"modified":"2026-10-28T18:15:04.634837228Z","published":"2026-10-28T17:09:59Z","references":[{"type":"WEB","url":"https://www.drupal.org/sa-contrib-2026-271"}],"affected":[{"package":{"name":"drupal/ai","ecosystem":"Packagist:https://packages.drupal.org/8","purl":"pkg:composer/drupal/ai?repository_url=https:%2F%2Fpackages.drupal.org%2F8"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.11"}],"database_specific":{"constraint":"\u003c1.4.11"}},{"type":"ECOSYSTEM","events":[{"introduced":"1.5.0"},{"fixed":"1.5.2"}],"database_specific":{"constraint":"\u003e=1.5.0 \u003c1.5.2"}}],"database_specific":{"affected_versions":"\u003c1.4.11 || \u003e=1.5.0 \u003c1.5.2","source":"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/ai/DRUPAL-CONTRIB-2026-271.json"}}],"schema_version":"1.9.2","credits":[{"name":"Marcus Johansson (marcus_johansson)","contact":["https://www.drupal.org/u/marcus_johansson"]}]}