Vulnerability Description
The File Force Download module for Drupal 7 implements hook_file_download() to add a Content-Disposition header when a file URL carries the download query parameter. In Drupal 7, returning a non-empty header array from that hook is itself a grant of access to the file. In versions 7.1.0 through 7.1.2, the module only delegated to other modules' hook_file_download() implementations when the file was in the private scheme. For every other scheme it returned its headers without any check. An unauthenticated visitor who appended download=1 to the URL of a file in the temporary:// scheme, or in a stream wrapper supplied by another module, could retrieve the file, overriding the access checks that would otherwise have applied. Files in the public and private schemes are not affected.
Related Weaknesses (CWE)
References
- https://d7es.tag1.com/security-advisories/file-force-download-critical-access-by
- https://www.herodevs.com/vulnerability-directory/cve-2026-110176
FAQ
What is CVE-2026-110176?
CVE-2026-110176 is a documented vulnerability. The File Force Download module for Drupal 7 implements hook_file_download() to add a Content-Disposition header when a file URL carries the download query parameter. In Drupal 7, returning a non-empty...
How severe is CVE-2026-110176?
CVSS scoring is not yet available for CVE-2026-110176. Check NVD for updates.
Is there a patch for CVE-2026-110176?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.