Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-110176— File Force Download for Drupal 7 Access Bypass via Unconditional Download Headers

Quick assessment

Affected
Drupal File Force Download
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Drupal 7 的 File Force Download 模块通过实现 hook_file_download() 钩子，在文件 URL 携带 download 查询参数时添加 Content-Disposition 响应头。在 Drupal 7 中，只要该钩子返回非空的响应头数组，即视为授予对该文件的访问权限。 在 7.1.0 至 7.1.2 版本中，该模块仅在文件位于 private 存储方案（scheme）时，才会将请求委托给其他模块的 hook_file_download() 实现；对于其他所有存储方案，

CVSS 8.7 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-110176

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
File Force Download for Drupal 7 Access Bypass via Unconditional Download Headers
Source: CVE Program / CVE List V5
Vulnerability Description
The File Force Download module for Drupal 7 implements hook_file_download() to add a Content-Disposition header when a file URL carries the download query parameter. In Drupal 7, returning a non-empty header array from that hook is itself a grant of access to the file. In versions 7.1.0 through 7.1.2, the module only delegated to other modules' hook_file_download() implementations when the file was in the private scheme. For every other scheme it returned its headers without any check. An unauthenticated visitor who appended download=1 to the URL of a file in the temporary:// scheme, or in a stream wrapper supplied by another module, could retrieve the file, overriding the access checks that would otherwise have applied. Files in the public and private schemes are not affected.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Drupal File Force Download 7.1.0 ~ 7.1.3 -

II. Public POCs for CVE-2026-110176

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-110176

请登录查看更多情报信息。

Other References for CVE-2026-110176 (2)

IV. Related Vulnerabilities

Same vendor: Drupal
Same weakness: CWE-863