CVE-2026-110176 in File Force Download Extension
Summary
by MITRE • 10/31/2026
The File Force Download module for Drupal 7 implements hook_file_download() to add a Content-Disposition header when a file URL carries the download query parameter. In Drupal 7, returning a non-empty header array from that hook is itself a grant of access to the file.
In versions 7.1.0 through 7.1.2, the module only delegated to other modules' hook_file_download() implementations when the file was in the private scheme. For every other scheme it returned its headers without any check. An unauthenticated visitor who appended download=1 to the URL of a file in the temporary:// scheme, or in a stream wrapper supplied by another module, could retrieve the file, overriding the access checks that would otherwise have applied. Files in the public and private schemes are not affected.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/31/2026
The File Force Download module for Drupal 7 introduces a critical authentication bypass vulnerability stemming from an improper implementation of the hook_file_download() interface. This hook is designed to allow modules to add headers, such as Content-Disposition, when specific conditions are met, but in the context of Drupal's file system architecture, returning any non-empty array from this function serves as an implicit grant of access to the requested resource. The vulnerability arises because the module fails to enforce standard access control checks before granting this permission for certain types of files. Specifically, versions 7.1.0 through 7.1.2 contain a logic flaw where the module delegates header generation only when the file resides in the private scheme. For all other schemes, including temporary and custom stream wrappers provided by third-party modules, the code returns headers unconditionally without verifying whether the requesting user has permission to view or download that specific file.
This architectural oversight allows an unauthenticated attacker to bypass standard Drupal access controls by appending a query parameter indicating a forced download action to URLs associated with files in vulnerable schemes. By targeting files stored in the temporary:// scheme, which is often used for transient data processing, or any custom stream wrapper implemented by other modules, an attacker can retrieve sensitive content that should otherwise be restricted. The vulnerability effectively neutralizes security measures intended to protect these resources because the module's logic prioritizes header generation over access validation for non-private files. Files stored in public and private schemes remain unaffected due to their distinct handling mechanisms within Drupal’s core file system, which do not rely on this specific hook implementation in a way that exposes them to this bypass technique.
From an industry standards perspective, this vulnerability is classified under CWE-284, Improper Access Control, as the application fails to restrict access to resources for unauthorized actors. It also aligns with ATT&CK techniques related to Unauthorized Access via API or Web Application flaws, where attackers exploit misconfigured permissions to extract data without valid credentials. The operational impact of this flaw is significant, particularly in environments that utilize temporary file storage for sensitive operations such as user uploads, document processing, or session management. An attacker could potentially exfiltrate confidential documents, personal identifiable information, or proprietary code snippets simply by manipulating the URL structure, leading to potential data breaches and compliance violations depending on the nature of the exposed files.
Mitigation strategies must focus on immediate patching and architectural review. Administrators running Drupal 7 should upgrade to a patched version of the File Force Download module where this logic error has been corrected to ensure that access checks are performed before any headers are returned, regardless of the file scheme. For organizations unable to update immediately due to legacy constraints, temporary mitigations include restricting write and read permissions on directories associated with the temporary:// stream wrapper at the server level or configuring web servers like Apache or Nginx to deny direct access to these paths unless explicitly allowed by application logic. Additionally, a thorough audit of custom modules implementing hook_file_download() is recommended to ensure they adhere to Drupal’s security best practices by validating user permissions before returning any file-related headers.