Project: 
AI (Artificial Intelligence)
Project machine name: 
ai
Date: 
2026-October-28
Security risk: 
Less critical 8 ∕ 25 AC:Complex/A:User/CI:Some/II:None/E:Theoretical/TD:Uncommon
Vulnerability: 
Information Disclosure
Affected versions: 
<1.4.11 || >=1.5.0 <1.5.2
CVE IDs: 
CVE-2026-118551
Description: 

This module provides a framework for integrating AI providers and features into Drupal.

Audio for every speech-to-text request is written to the same file in the temporary directory and does not delete it afterwards. As a result, an attacker who can read the site's temporary directory could get the audio that another user sent for transcription.

This vulnerability is mitigated by the fact that the attacker needs read access to the temporary directory, either through the server (for example a shared hosting account) or through a module or custom code that exposes temporary files to other users. Drupal core's system.temporary route only serves temporary files to the user who owns them.

Solution: 

Install the latest version:

  • If you use version 1.5.x, upgrade to AI 1.5.2.
  • If you use version 1.4.x, upgrade to AI 1.4.11.
  • If you use version 1.3.x, upgrade to AI 1.5.2 or AI 1.4.11 as the 1.3.x branch is now unsupported.

The fix keeps the audio in memory and no longer writes it to the temporary directory. Site owners may also want to delete any leftover speech_to_text.mp3 file in the temporary directory.

Reported By: 
Fixed By: 
Coordinated By: