Search
Find a vulnerability
Search criteria
2 vulnerabilities found for File Force Download by Drupal
CVE-2026-110176 (GCVE-0-2026-110176)
Vulnerability from nvd – Published: 2026-10-31 00:01 – Updated: 2026-10-31 00:01
VLAI
EPSS
VEX
Title
File Force Download for Drupal 7 Access Bypass via Unconditional Download Headers
Summary
The File Force Download module for Drupal 7 implements hook_file_download() to add a Content-Disposition header when a file URL carries the download query parameter. In Drupal 7, returning a non-empty header array from that hook is itself a grant of access to the file.
In versions 7.1.0 through 7.1.2, the module only delegated to other modules' hook_file_download() implementations when the file was in the private scheme. For every other scheme it returned its headers without any check. An unauthenticated visitor who appended download=1 to the URL of a file in the temporary:// scheme, or in a stream wrapper supplied by another module, could retrieve the file, overriding the access checks that would otherwise have applied. Files in the public and private schemes are not affected.
Severity
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.herodevs.com/vulnerability-directory/… | third-party-advisory |
| https://d7es.tag1.com/security-advisories/file-fo… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Drupal | File Force Download |
Affected:
7.1.0 , < 7.1.3
(semver)
|
Date Public
2026-09-02 06:00
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://www.drupal.org/project/file_force",
"defaultStatus": "unaffected",
"packageName": "file_force",
"platforms": [
"Drupal 7"
],
"product": "File Force Download",
"repo": "https://git.drupalcode.org/project/file_force",
"vendor": "Drupal",
"versions": [
{
"lessThan": "7.1.3",
"status": "affected",
"version": "7.1.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ra M\u00e4nd (ram4nd)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Ra M\u00e4nd (ram4nd)"
}
],
"datePublic": "2026-09-02T06:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe File Force Download module for Drupal 7 implements \u003ccode\u003ehook_file_download()\u003c/code\u003e to add a \u003ccode\u003eContent-Disposition\u003c/code\u003e header when a file URL carries the \u003ccode\u003edownload\u003c/code\u003e query parameter. In Drupal 7, returning a non-empty header array from that hook is itself a grant of access to the file.\u003c/p\u003e\u003cp\u003eIn versions 7.1.0 through 7.1.2, the module only delegated to other modules\u0027 \u003ccode\u003ehook_file_download()\u003c/code\u003e implementations when the file was in the \u003ccode\u003eprivate\u003c/code\u003e scheme. For every other scheme it returned its headers without any check. An unauthenticated visitor who appended \u003ccode\u003edownload=1\u003c/code\u003e to the URL of a file in the \u003ccode\u003etemporary://\u003c/code\u003e scheme, or in a stream wrapper supplied by another module, could retrieve the file, overriding the access checks that would otherwise have applied. Files in the public and private schemes are not affected.\u003c/p\u003e"
}
],
"value": "The File Force Download module for Drupal 7 implements hook_file_download() to add a Content-Disposition header when a file URL carries the download query parameter. In Drupal 7, returning a non-empty header array from that hook is itself a grant of access to the file.\n\n\n\nIn versions 7.1.0 through 7.1.2, the module only delegated to other modules\u0027 hook_file_download() implementations when the file was in the private scheme. For every other scheme it returned its headers without any check. An unauthenticated visitor who appended download=1 to the URL of a file in the temporary:// scheme, or in a stream wrapper supplied by another module, could retrieve the file, overriding the access checks that would otherwise have applied. Files in the public and private schemes are not affected."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-31T00:01:51.979Z",
"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
"shortName": "drupal"
},
"references": [
{
"name": "HeroDevs vulnerability directory: CVE-2026-110176",
"tags": [
"third-party-advisory"
],
"url": "https://www.herodevs.com/vulnerability-directory/cve-2026-110176"
},
{
"name": "Tag1 D7ES advisory: File Force Download - Critical - Access Bypass",
"tags": [
"third-party-advisory"
],
"url": "https://d7es.tag1.com/security-advisories/file-force-download-critical-access-bypass"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "File Force Download for Drupal 7 Access Bypass via Unconditional Download Headers",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eDisable the File Force Download module, avoid keeping sensitive files in the temporary:// scheme or in stream wrappers provided by contributed modules, or block anonymous requests that carry a download parameter at the web server or WAF.\u003c/p\u003e"
}
],
"value": "Disable the File Force Download module, avoid keeping sensitive files in the temporary:// scheme or in stream wrappers provided by contributed modules, or block anonymous requests that carry a download parameter at the web server or WAF."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
"assignerShortName": "drupal",
"cveId": "CVE-2026-110176",
"datePublished": "2026-10-31T00:01:51.979Z",
"dateReserved": "2026-10-13T17:02:57.071Z",
"dateUpdated": "2026-10-31T00:01:51.979Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110176 (GCVE-0-2026-110176)
Vulnerability from cvelistv5 – Published: 2026-10-31 00:01 – Updated: 2026-10-31 00:01
VLAI
EPSS
VEX
Title
File Force Download for Drupal 7 Access Bypass via Unconditional Download Headers
Summary
The File Force Download module for Drupal 7 implements hook_file_download() to add a Content-Disposition header when a file URL carries the download query parameter. In Drupal 7, returning a non-empty header array from that hook is itself a grant of access to the file.
In versions 7.1.0 through 7.1.2, the module only delegated to other modules' hook_file_download() implementations when the file was in the private scheme. For every other scheme it returned its headers without any check. An unauthenticated visitor who appended download=1 to the URL of a file in the temporary:// scheme, or in a stream wrapper supplied by another module, could retrieve the file, overriding the access checks that would otherwise have applied. Files in the public and private schemes are not affected.
Severity
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.herodevs.com/vulnerability-directory/… | third-party-advisory |
| https://d7es.tag1.com/security-advisories/file-fo… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Drupal | File Force Download |
Affected:
7.1.0 , < 7.1.3
(semver)
|
Date Public
2026-09-02 06:00
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://www.drupal.org/project/file_force",
"defaultStatus": "unaffected",
"packageName": "file_force",
"platforms": [
"Drupal 7"
],
"product": "File Force Download",
"repo": "https://git.drupalcode.org/project/file_force",
"vendor": "Drupal",
"versions": [
{
"lessThan": "7.1.3",
"status": "affected",
"version": "7.1.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ra M\u00e4nd (ram4nd)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Ra M\u00e4nd (ram4nd)"
}
],
"datePublic": "2026-09-02T06:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe File Force Download module for Drupal 7 implements \u003ccode\u003ehook_file_download()\u003c/code\u003e to add a \u003ccode\u003eContent-Disposition\u003c/code\u003e header when a file URL carries the \u003ccode\u003edownload\u003c/code\u003e query parameter. In Drupal 7, returning a non-empty header array from that hook is itself a grant of access to the file.\u003c/p\u003e\u003cp\u003eIn versions 7.1.0 through 7.1.2, the module only delegated to other modules\u0027 \u003ccode\u003ehook_file_download()\u003c/code\u003e implementations when the file was in the \u003ccode\u003eprivate\u003c/code\u003e scheme. For every other scheme it returned its headers without any check. An unauthenticated visitor who appended \u003ccode\u003edownload=1\u003c/code\u003e to the URL of a file in the \u003ccode\u003etemporary://\u003c/code\u003e scheme, or in a stream wrapper supplied by another module, could retrieve the file, overriding the access checks that would otherwise have applied. Files in the public and private schemes are not affected.\u003c/p\u003e"
}
],
"value": "The File Force Download module for Drupal 7 implements hook_file_download() to add a Content-Disposition header when a file URL carries the download query parameter. In Drupal 7, returning a non-empty header array from that hook is itself a grant of access to the file.\n\n\n\nIn versions 7.1.0 through 7.1.2, the module only delegated to other modules\u0027 hook_file_download() implementations when the file was in the private scheme. For every other scheme it returned its headers without any check. An unauthenticated visitor who appended download=1 to the URL of a file in the temporary:// scheme, or in a stream wrapper supplied by another module, could retrieve the file, overriding the access checks that would otherwise have applied. Files in the public and private schemes are not affected."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-31T00:01:51.979Z",
"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
"shortName": "drupal"
},
"references": [
{
"name": "HeroDevs vulnerability directory: CVE-2026-110176",
"tags": [
"third-party-advisory"
],
"url": "https://www.herodevs.com/vulnerability-directory/cve-2026-110176"
},
{
"name": "Tag1 D7ES advisory: File Force Download - Critical - Access Bypass",
"tags": [
"third-party-advisory"
],
"url": "https://d7es.tag1.com/security-advisories/file-force-download-critical-access-bypass"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "File Force Download for Drupal 7 Access Bypass via Unconditional Download Headers",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eDisable the File Force Download module, avoid keeping sensitive files in the temporary:// scheme or in stream wrappers provided by contributed modules, or block anonymous requests that carry a download parameter at the web server or WAF.\u003c/p\u003e"
}
],
"value": "Disable the File Force Download module, avoid keeping sensitive files in the temporary:// scheme or in stream wrappers provided by contributed modules, or block anonymous requests that carry a download parameter at the web server or WAF."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
"assignerShortName": "drupal",
"cveId": "CVE-2026-110176",
"datePublished": "2026-10-31T00:01:51.979Z",
"dateReserved": "2026-10-13T17:02:57.071Z",
"dateUpdated": "2026-10-31T00:01:51.979Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}