CVE-2011-2726

score

<0.1

cvss

7.5

epss

1.6%

published

2019-11-15

kev added

—

first seen

2026-10-21

Drupal 7.x before 7.5 contains an access bypass caused by improper access control on file attachments, letting non-privileged users download files if they know or guess the direct URL, exploit requires the ability to attach file upload fields or point to private directory.