Live › vulnerability › CVE-2026-110176
In versions 7.1.0 through 7.1.2 of the File Force Download module for Drupal 7, appending download=1 to a file URL in the temporary scheme or another module's stream wrapper skips the normal access checks. An unauthenticated visitor can retrieve files they should not be able to read.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-31 01:32 UTC. All times on this page are UTC.
Sites running Drupal 7 with the File Force Download module at versions 7.1.0 through 7.1.2 that serve files from the temporary scheme or a third-party stream wrapper. Files in the public and private schemes are not affected, so sites that only use those schemes can skip it.
No product ranges from the sources yet.
drush pm-list output7.1.2 or later is affected only up to 7.1.2; the fixed version is not stated in the sources, so check the project page for the release that corrects thisEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The File Force Download module for Drupal 7 implements hook_file_download() to add a Content-Disposition header when a file URL carries the download query parameter. In Drupal 7, returning a non-empty header array from that hook is itself a grant of access to the file.
In versions 7.1.0 through 7.1.2, the module only delegated to other modules' hook_file_download() implementations when the file was in the private scheme. For every other scheme it returned its headers without any check. An unauthenticated visitor who appended download=1 to the URL of a file in the temporary:// scheme, or in a stream wrapper supplied by another module, could retrieve the file, overriding the access checks that would otherwise have applied. Files in the public and private schemes are not affected.
This page as .md · .json · in your agent: get_signal("CVE-2026-110176")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.