PT-2026-134258
CVE-2026-110176
·
Published
2026-10-31
·
Updated
2026-11-03
Description by
CVSS 4.0
8.7
HighMetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
File Force Download module for Drupal 7 versions 7.1.0 through 7.1.2
Description
The module implements the
hook file download() function to add a Content-Disposition header when a file URL contains the download query parameter. In Drupal 7, returning a non-empty header array from this hook grants access to the file. The module failed to perform access checks for files in the temporary:// scheme or stream wrappers provided by other modules, only delegating to other hook file download() implementations for files in the private scheme. Consequently, an unauthenticated visitor can retrieve these files by appending download=1 to the URL, bypassing intended access controls.Recommendations
Update File Force Download module for Drupal 7 to a version later than 7.1.2.
Exploitability
Exploit
Fix
Impacts
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾