There’s some discussion about this in the thread: What to do in case of hash collision?
With SHA256 it’s unlikely that someone will find an SHA256 collision – IPFS’ current hashing algorithm – any time soon. However, if someone does find a weakness in SHA256 then the network can move to a different hashing algorithm instead since IPFS uses multihashes.
To quote whyrusleeping from the linked thread:
Lets assume that the entire bitcoin mining economy decides to try and find an ipfs object hash collision, checking hashes at a rate of 400 Petahash (400,000,000,000,000,000 hashes per second) it would take them 2.810^59 seconds, or 910^51 years to compute the entire space.
As a side-note:
There are even more multihashes than just the one for the whole file. For larger files, they are broken into chunks behind the scenes and every chunk gets its own multihash as well.