File Force Download for Drupal 7 Access Bypass via Unconditional Download Headers
Only affects File Force Download 7.1.0 through 7.1.2 on Drupal 7, for files in temporary:// or in stream wrappers from other modules. Fixed in 7.1.3.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Unclear
- Fix
- Fixed in 7.1.3
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The File Force Download module for Drupal 7, versions 7.1.0 through 7.1.2, is affected. An unauthenticated visitor could bypass file access controls and download files stored in the temporary scheme or in certain other stream wrappers by adding a download parameter to the file URL.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
The File Force Download module for Drupal 7 implements hook_file_download() to add a Content-Disposition header when a file URL carries the download query parameter. In Drupal 7, returning a non-empty header array from that hook is itself a grant of access to the file. In versions 7.1.0 through 7.1.2, the module only delegated to other modules' hook_file_download() implementations when the file was in the private scheme. For every other scheme it returned its headers without any check. An unauthenticated visitor who appended download=1 to the URL of a file in the temporary:// scheme, or in a stream wrapper supplied by another module, could retrieve the file, overriding the access checks that would otherwise have applied. Files in the public and private schemes are not affected.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- file_force
From 7.1.0 · fixed in 7.1.3
References 2
Questions about CVE-2026-110176
What does this mean?
An unauthenticated visitor can read files they have no access to, such as temporary files or files served by stream wrappers from other modules, by adding a download parameter to the file URL.Source: herodevs.com
Am I affected, and how do I check?
File Force Download module versions 7.1.0 through 7.1.2 for Drupal 7 are listed as affected. Only files in the temporary:// scheme or in a stream wrapper supplied by another module are covered; files in the public and private schemes are not affected. Check the installed File Force Download version and where the files are stored.Source: herodevs.com
What should I do about it?
Upgrade File Force Download to 7.1.3, the fixed version listed in the advisory.Source: herodevs.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data