Still on Drupal 7? Security support for Drupal 7 ended on 5 January 2025. Please visit our Drupal 7 End of Life resources page to review all of your options.
Under certain circumstances, Drupal will allow for aliases and redirects to override existing paths, and it does not check to see that a URL may be in use before allowing it.