{"id":"CVE-2026-110176","kind":"vulnerability","aliases":["CVE-2026-110176"],"related":[],"title":"Drupal File Force Download module lets anonymous users fetch protected files","description":"The File Force Download module for Drupal 7 implements hook_file_download() to add a Content-Disposition header when a file URL carries the download query parameter. In Drupal 7, returning a non-empty header array from that hook is itself a grant of access to the file.\n\n\n\nIn versions 7.1.0 through 7.1.2, the module only delegated to other modules' hook_file_download() implementations when the file was in the private scheme. For every other scheme it returned its headers without any check. An unauthenticated visitor who appended download=1 to the URL of a file in the temporary:// scheme, or in a stream wrapper supplied by another module, could retrieve the file, overriding the access checks that would otherwise have applied. Files in the public and private schemes are not affected.","summary":"In versions 7.1.0 through 7.1.2 of the File Force Download module for Drupal 7, appending download=1 to a file URL in the temporary scheme or another module's stream wrapper skips the normal access checks. An unauthenticated visitor can retrieve files they should not be able to read.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","drupal-7","file-force-download","package"],"not_affected_if":["module-version-outside-7.1.0-7.1.2","not-drupal-7","public-or-private-schemes-only"],"how_to_check":"- Check the installed File Force Download module version in the Drupal 7 site's module list or `drush pm-list` output\n- Look for files stored under the temporary:// scheme or a custom stream wrapper that are reachable by URL with the download parameter","fix":"- File Force Download `7.1.2` or later is affected only up to `7.1.2`; the fixed version is not stated in the sources, so check the project page for the release that corrects this","status":"open","published_at":"2026-10-31T01:17:05+00:00","first_seen_at":"2026-10-31T01:32:49+00:00","triaged_at":"2026-10-31T01:33:48+00:00","updated_at":"2026-10-31T01:33:48+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-31T01:33:48Z","model":"claude-haiku-5-5","output":{"fix":"- File Force Download `7.1.2` or later is affected only up to `7.1.2`; the fixed version is not stated in the sources, so check the project page for the release that corrects this","reach":"internet","title":"Drupal File Force Download module lets anonymous users fetch protected files","impact":"medium","summary":"In versions 7.1.0 through 7.1.2 of the File Force Download module for Drupal 7, appending download=1 to a file URL in the temporary scheme or another module's stream wrapper skips the normal access checks. An unauthenticated visitor can retrieve files they should not be able to read.","audience":"developers","category":"package","nicknames":[],"who_cares":["drupal","drupal-7","file-force-download"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"unauthenticated visitors read protected files they should not access","analyst_note":"Sources list no fixed version or patch link; find the corrected release of File Force Download and confirm the NVD entry against the Drupal project page.","how_to_check":"- Check the installed File Force Download module version in the Drupal 7 site's module list or `drush pm-list` output\n- Look for files stored under the temporary:// scheme or a custom stream wrapper that are reachable by URL with the download parameter","plain_action":"","needs_analyst":true,"not_affected_if":["not-drupal-7","module-version-outside-7.1.0-7.1.2","public-or-private-schemes-only"],"who_is_affected":"Sites running Drupal 7 with the File Force Download module at versions 7.1.0 through 7.1.2 that serve files from the temporary scheme or a third-party stream wrapper. Files in the public and private schemes are not affected, so sites that only use those schemes can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000747,"input_tokens":4264,"output_tokens":642,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-110176':14A,17A '-2026':13A,16A '-7':20B '1':42B,166C '7':39B,82C,105C '7.1.0':28B,127C '7.1.2':30B,129C 'abl':72B 'access':60B,121C,191C 'add':88C 'affect':207C 'anonym':7A 'anoth':52B,183C 'append':40B,164C 'appli':197C 'array':112C 'carri':98C 'check':61B,159C,192C 'content':91C 'content-disposit':90C 'could':185C 'cve':12A,15A 'deleg':133C 'disposit':92C 'download':4A,24B,35B,41B,78C,86C,100C,139C,165C 'drupal':1A,18B,19B,38B,81C,104C 'empti':110C 'everi':150C 'fetch':9A 'file':2A,11A,22B,33B,45B,67B,76C,85C,96C,124C,138C,143C,172C,188C,198C 'file-force-download':21B 'forc':3A,23B,34B,77C 'grant':119C 'header':93C,111C,156C 'hook':84C,115C,137C 'implement':83C,140C 'let':6A 'modul':5A,36B,53B,79C,131C,136C,184C 'non':109C 'non-empti':108C 'normal':59B 'otherwis':195C 'overrid':189C 'packag':25B 'paramet':102C 'privat':147C,203C 'protect':10A 'public':201C 'queri':101C 'read':74B 'retriev':66B,186C 'return':106C,154C 'scheme':50B,148C,152C,175C,204C 'skip':57B 'stream':55B,179C 'suppli':181C 'temporari':49B 'unauthent':63B,161C 'url':46B,97C,169C 'user':8A 'version':27B,126C 'visitor':64B,162C 'without':157C 'would':194C 'wrapper':56B,180C","nicknames":[],"mitigations":[],"who_affected":"Sites running Drupal 7 with the File Force Download module at versions 7.1.0 through 7.1.2 that serve files from the temporary scheme or a third-party stream wrapper. Files in the public and private schemes are not affected, so sites that only use those schemes can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"developers","plain_action":null,"first_public_at":"2026-10-31T01:17:05+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"mlhess@drupal.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110176","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110176","severity":null,"published_at":"2026-10-31T01:17:05+00:00","modified_at":"2026-10-31T01:17:05+00:00","first_seen_at":"2026-10-31T01:32:49+00:00","fetched_at":"2026-10-31T01:32:49+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}