---
id: "CVE-2026-110176"
kind: "vulnerability"
aliases: ["CVE-2026-110176"]
title: "Drupal File Force Download module lets anonymous users fetch protected files"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["drupal", "drupal-7", "file-force-download", "package"]
not_affected_if: ["module-version-outside-7.1.0-7.1.2", "not-drupal-7", "public-or-private-schemes-only"]
published_at: "2026-10-31T01:17:05+00:00"
first_seen_at: "2026-10-31T01:32:49+00:00"
updated_at: "2026-10-31T01:33:48+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110176", "first_seen_at": "2026-10-31T01:32:49+00:00"}]
---

# Drupal File Force Download module lets anonymous users fetch protected files

In versions 7.1.0 through 7.1.2 of the File Force Download module for Drupal 7, appending download=1 to a file URL in the temporary scheme or another module's stream wrapper skips the normal access checks. An unauthenticated visitor can retrieve files they should not be able to read.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed File Force Download module version in the Drupal 7 site's module list or `drush pm-list` output
- Look for files stored under the temporary:// scheme or a custom stream wrapper that are reachable by URL with the download parameter

## Fix

- File Force Download `7.1.2` or later is affected only up to `7.1.2`; the fixed version is not stated in the sources, so check the project page for the release that corrects this

## Timeline

- 2026-10-31T01:32:49+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-110176

## From the sources

The File Force Download module for Drupal 7 implements hook_file_download() to add a Content-Disposition header when a file URL carries the download query parameter. In Drupal 7, returning a non-empty header array from that hook is itself a grant of access to the file.



In versions 7.1.0 through 7.1.2, the module only delegated to other modules' hook_file_download() implementations when the file was in the private scheme. For every other scheme it returned its headers without any check. An unauthenticated visitor who appended download=1 to the URL of a file in the temporary:// scheme, or in a stream wrapper supplied by another module, could retrieve the file, overriding the access checks that would otherwise have applied. Files in the public and private schemes are not affected.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_