The File Force Download module for Drupal 7, versions 7.1.0 to 7.1.2, returns download headers for files in the temporary:// scheme and for files from stream wrappers of other modules without checking access. An unauthenticated visitor can retrieve such files by appending download=1 to the file URL, which bypasses the access checks that would otherwise apply. Files in the public and private schemes are not affected. The CVSS 4.0 base score is 8.7 (High), and the impact is limited to confidentiality.
Drupal · File Force Download
The Drupal contrib module Block AJAX (block_ajax) does not sufficiently validate user-supplied data it uses to construct a block. In the worst case, this can lead to PHP object injection and remote code execution. According to Drupal, the issue only affects sites with Layout Builder enabled or another block plugin that handles the data unsafely; the authentication requirements are not yet confirmed.
Drupal · Block AJAX
The contributed Drupal module Webform, used for forms and submission handling, contains a template engine injection flaw (CWE-1336). Drupal's advisory states that it is mitigated unless a form uses a custom multiple-value item format that includes submission-value tokens. Depending on the site configuration and enabled modules, an attacker who can submit data may be able to cause information disclosure, stored cross-site scripting or remote code execution. The CVSS 9.1 score in the ticket is not yet confirmed by NVD.
Drupal · Webform
