File Force Download CVE-2026-110176

Exploitable only when the File Force Download module version 7.1.0 through 7.1.2 is installed on Drupal 7 AND the target file resides in the temporary:// scheme or in a stream wrapper supplied by another module; the attacker simply appends the download=1 query parameter to that file's URL, and the module returns its Content-Disposition header without delegating to other modules' access checks (which it only did for the private scheme). No authentication is required (PR:N) and no user interaction (UI:N). Limiting factors: files served from the public:// and private:// schemes are explicitly NOT affected, so sites that store no sensitive files in temporary:// or custom stream wrappers are not meaningfully exposed; the vulnerable contributed module must be present, and exposure depends on an attacker being able to reach or guess the specific file URL.

The source CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N) describes a remotely reachable, low-complexity, unauthenticated flaw with high confidentiality impact and no integrity or availability impact - consistent with the CWE-863 authorization/access-bypass nature of the bug. These signals point to trivial exploitation (just an HTTP request with download=1), but several real-world-risk signals are either moderate or absent: the vuln.today decision label is 'this_week' (not act_now/emergency), the vulnerability is NOT listed in CISA KEV, no EPSS exploitation-probability score was supplied, and no confirmed public exploit code is present in the input (the two references are vendor/third-party advisories, not PoC/exploit listings). The practical risk is further scoped by preconditions: only files in the temporary:// scheme or in a stream wrapper supplied by another module are exposed, while files in the default public:// and private:// schemes are explicitly unaffected, and the vulnerable File Force Download module (versions 7.1.0-7.1.2) must be installed on a Drupal 7 site. Net assessment: a genuine unauthenticated information-disclosure issue that warrants prompt patching on affected installations, but its blast radius is limited to a specific contributed module and non-default file schemes rather than being a widespread internet-wide emergency; the high CVSS reflects ease of exploitation, not ubiquity of exposure.

An unauthenticated attacker who knows or guesses the URL of a file stored in the temporary:// scheme (or in a custom stream wrapper provided by another module) on a Drupal 7 site running File Force Download 7.1.0-7.1.2 appends download=1 to that URL. The module returns a non-empty Content-Disposition header, which Drupal 7 treats as a grant of access, so the file is served despite the access checks that should have denied it. No public exploit was identified at time of analysis, though the technique is simple to reproduce from the advisory given AV:N/AC:L/PR:N/UI:N.