CVE-2026-110176

Overview

Drupal is an open-source content management system known for its flexibility, robust features, and strong community support. Organizations of all sizes use it to build and manage dynamic websites and web applications.

File Force Download overrides how a visitor's browser handles a requested file, forcing it either to save the file to disk or to display it inline rather than letting the browser decide. It works by adding a Content-Disposition header to file responses, and provides file and image field formatters that generate links carrying the parameter that selects the behavior.

Broken Access Control occurs when an application fails to properly enforce restrictions on what authenticated users are allowed to do, enabling attackers to access unauthorized functionality, data, or resources. It often stems from inadequate validation of user permissions, allowing someone to bypass intended security boundaries and perform actions beyond their assigned role.

On affected sites, an unauthenticated visitor could read files they have no access to, such as temporary files or files served by stream wrappers from other modules, by adding a download parameter to the file URL.

Details

Module Info

• Product: Drupal 7
• Affected packages: File Force Download
• Affected versions: >=7.1.0 <=7.1.2
• Repository: https://www.drupal.org/project/file_force
• Published packages: https://www.drupal.org/project/file_force
• Package manager: composer
• Fixed in: File Force Download NES 7.1.3

Vulnerability Info

This high-severity vulnerability is found in versions of the File Force Download module for Drupal 7 from 7.1.0 through 7.1.2 (inclusive).

The module implements hook_file_download() to add a Content-Disposition header when a file URL carries the download parameter. In Drupal 7, returning a non-empty header array from that hook is itself a grant of access to the file. The module delegated to other modules' hook_file_download() implementations only when the file was in the private scheme. For every other scheme it returned its headers without any check.

In practical terms, an unauthenticated visitor who appended &download=1 to the URL of a file in temporary://, or in a stream wrapper supplied by another module, received the file. That overrode the access checks the other module would otherwise have applied. Files in the public and private schemes were not affected.

Addressing the Issue

Users of this module should apply one of the following mitigations:

• If the risk is unacceptable, disable the File Force Download module until the fix can be deployed.
• Do not keep sensitive files in the temporary:// scheme or in stream wrappers provided by contributed modules until the fix is deployed.
• Block anonymous requests to /system/temporary that carry a download parameter at the web server or WAF.
• Sign up for post-EOL security support—HeroDevs customers get immediate access to a patched version of this module.

Credits

• Ra Mänd (ram4nd)