CVE-2026-110176

Dashboard / Vulnerabilities / CVE-2026-110176

CVE-2026-110176

Summary: File Force Download for Drupal 7 Access Bypass via Unconditional Download Headers

Details: The File Force Download module for Drupal 7 implements hook_file_download() to add a Content-Disposition header when a file URL carries the download query parameter. In Drupal 7, returning a non-empty header array from that hook is itself a grant of access to the file. In versions 7.1.0 through 7.1.2, the module only delegated to other modules' hook_file_download() implementations when the file was in the private scheme. For every other scheme it returned its headers without any check. An unauthenticated visitor who appended download=1 to the URL of a file in the temporary:// scheme, or in a stream wrapper supplied by another module, could retrieve the file, overriding the access checks that would otherwise have applied. Files in the public and private schemes are not affected.

References: https://git.drupalcode.org/project/file_force, https://www.drupal.org/project/file_force, https://d7es.tag1.com/security-advisories/file-force-download-critical-access-bypass, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110176.json, https://nvd.nist.gov/vuln/detail/CVE-2026-110176, https://www.herodevs.com/vulnerability-directory/cve-2026-110176