# CVE-2026-118551: Drupal AI module information disclosure in speech-to-text audio

Source: https://junglewise.ai/threats/cve-2026-118551-drupal-contrib-2026-271-this-module-provides-a-framework-for  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-118551 · Severity: info · Published 2026-10-30

Drupal's AI integration module writes audio files from speech-to-text requests to the temporary directory without deleting them, allowing attackers with read access to that directory to retrieve transcription audio from other users. This creates a data exposure risk for sensitive audio content, though exploitation requires the attacker to already have server or directory access through shared hosting or other exposed file mechanisms.

Technologies: [Drupal AI](https://junglewise.ai/threats/technologies/drupal-ai-1), [Packagist:Https://Packages.Drupal.Org/8 Drupal/Ai](https://junglewise.ai/threats/technologies/drupal-ai). Vendors: [Drupal](https://junglewise.ai/threats/vendors/drupal), [Packagist:Https://Packages.Drupal.Org/8](https://junglewise.ai/threats/vendors/packagist-https-packages-drupal-org-8).

## Quick answers

**Is CVE-2026-118551 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-118551 being exploited in the wild.

**How severe is CVE-2026-118551?** Informational severity, published 30 October 2026.

**Which products and versions are affected?** Drupal AI all versions before 1.4.11; 1.5.0 before 1.5.2; Packagist:Https://Packages.Drupal.Org/8 Drupal/Ai ECOSYSTEM:introduced=0,fixed=1.4.11|ECOSYSTEM:introduced=1.5.0,fixed=1.5.2.

**Is there a fix for CVE-2026-118551?** Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Ai: upgrade to 1.4.11 or later. Until then: Delete any leftover speech_to_text.mp3 files from the site's temporary directory to remove already-exposed audio. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-118551 attacked?** It is attacked with local access or from the adjacent network, in a software library.

**Am I affected by CVE-2026-118551?** Check whether you run Drupal AI or Packagist:Https://Packages.Drupal.Org/8 Drupal/Ai at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Packagist:Https://Packages.Drupal.Org/8 Drupal/Ai: upgrade to 1.4.11 or later

Delete any leftover speech_to_text.mp3 files from the site's temporary directory to remove already-exposed audio.

## Technical details

The vulnerability is an information disclosure flaw where the AI module persists audio files in a shared temporary directory without cleanup. An attacker with local or adjacent access to the temporary directory (via shared hosting, exposed file endpoints, or privilege escalation) can recover speech-to-text audio intended for other users. The fix moves audio handling to memory-only, eliminating filesystem persistence.

## Affected products

- Drupal AI all versions before 1.4.11; 1.5.0 before 1.5.2

## Identifiers

- CVE-2026-118551
- DRUPAL-CONTRIB-2026-271

## Timeline

- 2026-10-28: disclosed

## References

- [https://www.drupal.org/u/marcus_johansson](https://www.drupal.org/u/marcus_johansson)
- [https://www.drupal.org/sa-contrib-2026-271](https://www.drupal.org/sa-contrib-2026-271)

## Related threats

- [Drupal AI Automator text format access bypass](https://junglewise.ai/threats/cve-2026-118553-drupal-contrib-2026-273-the-ai-module-includes-a-submodule-ai)
- [Drupal AI module cross-site scripting in HTMX attributes](https://junglewise.ai/threats/cve-2026-118552-drupal-contrib-2026-272-this-module-provides-a-framework-for)
- [Drupal AI module information disclosure in Search API caching](https://junglewise.ai/threats/cve-2026-118550-drupal-contrib-2026-270-this-module-provides-a-framework-for)
- [Drupal AI module insufficient Markdown link validation XSS](https://junglewise.ai/threats/cve-2026-118549-drupal-contrib-2026-269-this-ai-module-enables-you-to-interact)
- [Drupal AI module insufficient link validation](https://junglewise.ai/threats/cve-2026-118548-drupal-contrib-2026-268-this-module-enables-you-to-use-ai-on-the)