CVE-2026-110176 File Force Download for Drupal 7 Access Bypass via Unconditional Download Headers

The File Force Download module for Drupal 7 implements hookfiledownload to add a Content-Disposition header when a file URL carries the download query parameter. In Drupal 7, returning a non-empty header array from that hook is itself a grant of access to the file. In versions 7.1.0 through 7.1.2...

CVE-2026-110176

The File Force Download module for Drupal 7 (versions 7.1.0 through 7.1.2) contains an access bypass vulnerability. The module implements hook_file_download() to add a Content-Disposition header when the download=1 query parameter is present. However, it fails to perform access checks for schemes...