File Force Download for Drupal 7: Access control bypass
Summary
The File Force Download module for Drupal 7, versions 7.1.0 to 7.1.2, returns download headers for files in the temporary:// scheme and for files from stream wrappers of other modules without checking access. An unauthenticated visitor can retrieve such files by appending download=1 to the file URL, which bypasses the access checks that would otherwise apply. Files in the public and private schemes are not affected. The CVSS 4.0 base score is 8.7 (High), and the impact is limited to confidentiality.
Affected
- File Force Download for Drupal 7, versions 7.1.0 to 7.1.2
- Only sites with files in the temporary:// scheme or in stream wrappers provided by other modules are exploitable
- Default configuration: unaffected (per the CNA record)
Fixed in
- File Force Download 7.1.3 (per HeroDevs and OffSeq)
- Also available as File Force Download NES 7.1.3 from HeroDevs (commercial Never-Ending Support)
- Unknown: whether 7.1.3 is currently published on drupal.org
Workaround
- Disable the File Force Download module until the fix is deployed
- Do not keep sensitive files in the temporary:// scheme or in stream wrappers from contributed modules
- Block anonymous requests to /system/temporary that carry a download parameter at the web server or WAF
Exploitation
- Not known to be exploited in the wild (OffSeq; KEV: No)
- VulDB reports no public exploit available; no public proof of concept was found in research
- Reported by Positive Technologies (PT-2026-134258)
Our recommendation
- Check whether the File Force Download module is installed on Drupal 7 sites and which version runs
- If the version is 7.1.0 to 7.1.2, disable the module or upgrade to 7.1.3 after confirming the release
- If patching is delayed, apply the WAF rule and review web server logs for anonymous requests with a download parameter
- Keep sensitive files out of the temporary:// scheme
- Plan the migration away from Drupal 7, which is end-of-life
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Tag1 D7ES security advisory d7es.tag1.com
- HeroDevs vulnerability directory www.herodevs.com
- drupal.org project: File Force Download www.drupal.org
- VulDB entry 429455 vuldb.com
- Positive Technologies PT-2026-134258 vulners.com
- Strix CVE summary www.strix.ai
- OffSeq threat radar entry radar.offseq.com
- CVE record mirror (threatint) cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 23:14.
Original description (NVD)
The File Force Download module for Drupal 7 implements hook_file_download() to add a Content-Disposition header when a file URL carries the download query parameter. In Drupal 7, returning a non-empty header array from that hook is itself a grant of access to the file. In versions 7.1.0 through 7.1.2, the module only delegated to other modules' hook_file_download() implementations when the file was in the private scheme. For every other scheme it returned its headers without any check. An unauthenticated visitor who appended download=1 to the URL of a file in the temporary:// scheme, or in a stream wrapper supplied by another module, could retrieve the file, overriding the access checks that would otherwise have applied. Files in the public and private schemes are not affected.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.