Access Bypass in File Force Download Module for Drupal 7 by HeroDevs
CVE-2026-110176

8.7HIGH

Key Information:

Vendor

Drupal
Status
File Force Download
Vendor
CVE Published:
31 October 2026

What is CVE-2026-110176?

The File Force Download module for Drupal 7 contains a vulnerability that allows unauthenticated users to access files through manipulation of the download query parameter. Specifically, versions 7.1.0 to 7.1.2 fail to implement adequate access controls when handling file downloads in schemes other than private. When an unauthenticated user appends 'download=1' to a URL for files in the temporary scheme or in stream wrappers provided by other modules, they can bypass necessary access checks, potentially exposing sensitive file data. This security flaw does not affect files in the public or private schemes.

Affected Version(s)

File Force Download Drupal 7 7.1.0 < 7.1.3

References

https://www.herodevs.com/vulnerability-directory/cve-2026...
third-party-advisory
https://d7es.tag1.com/security-advisories/file-force-down...
third-party-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ra Mänd (ram4nd)
Ra Mänd (ram4nd)
.