5 matches found
CVE-2026-110176
The File Force Download module for Drupal 7 implements hookfiledownload to add a Content-Disposition header when a file URL carries the download query parameter. In Drupal 7, returning a non-empty header array from that hook is itself a grant of access to the file. In versions 7.1.0 through 7.1.2...
CVE-2026-110176 File Force Download for Drupal 7 Access Bypass via Unconditional Download Headers
The File Force Download module for Drupal 7 implements hookfiledownload to add a Content-Disposition header when a file URL carries the download query parameter. In Drupal 7, returning a non-empty header array from that hook is itself a grant of access to the file. In versions 7.1.0 through 7.1.2...
CVE-2026-110176
The File Force Download module for Drupal 7 (versions 7.1.0 through 7.1.2) contains an access bypass vulnerability. The module implements hook_file_download() to add a Content-Disposition header when the download=1 query parameter is present. However, it fails to perform access checks for schemes...
EUVD-2026-114570
The File Force Download module for Drupal 7 implements hookfiledownload to add a Content-Disposition header when a file URL carries the download query parameter. In Drupal 7, returning a non-empty header array from that hook is itself a grant of access to the file. In versions 7.1.0 through 7.1.2...
CVE-2026-110176: Drupal File Force Download: The File Force Download module for Drupal 7 implements hook_file_download() to add a Content-Disposition header when a…
The File Force Download module for Drupal 7 implements hookfiledownload to add a Content-Disposition header when a file URL carries the download query parameter. In Drupal 7, returning a non-empty header array from that hook is itself a grant of access to the file. In versions 7.1.0 through 7.1.2...