Drupal AI File to Text: a tool reads files the user cannot download
AI File to Text let a caller with AI tool access read the text of files they could not otherwise download.
· Drupal Security Team · Research by Marcus Johansson
Drupal's AI File to Text module did not check whether a user may view a file before extracting its text for AI agents, so a caller with AI tool permission could read private-filesystem files. Release 1.0.1 fixes it.
01What happened
The Drupal Security Team published SA-CONTRIB-2026-251 on October 21, 2026 for the AI File to Text module and rated it moderately critical, 11 of 25 on Drupal's scale. Marcus Johansson reported the access bypass, and version 1.0.1 shipped the same day. The flaw is tracked as CVE-2026-114554.
02How it works
The module extracts text from uploaded Word, PDF, OpenDocument, CSV, Markdown and plain text files, and exposes that extraction to AI agents and automators as a tool. The tool does not adequately check whether the current user may view a file before it reads the contents. Pointing the agent at a file therefore returns text from files the caller has no permission to download, including files held in Drupal's private file system.
03Who is affected
Drupal sites running AI File to Text earlier than 1.0.1 are affected. Exploitation needs an account in a role that may invoke AI tools, through an agent or through the AI API Explorer, so exposure depends on which roles hold that permission.
04What to do
Upgrade to AI File to Text 1.0.1. Review which roles may invoke AI tools and remove the permission where a role does not need it.
Sources 2 links, all fetched
- 1drupal.orgDrupal Advisory
- 2drupal.orgRelease 1.0.1