File Force Download
Monthly
Unauthenticated file disclosure in the Drupal 7 File Force Download module (versions 7.1.0 through 7.1.2) allows a remote visitor to append download=1 to a file URL and retrieve files stored in the temporary:// scheme or in a stream wrapper supplied by another module without the access checks that should apply. Files in the public:// and private:// schemes are explicitly not affected, and the supplied data contains no indication of active exploitation; no public exploit identified at time of analysis.
Unauthenticated file disclosure in the Drupal 7 File Force Download module (versions 7.1.0 through 7.1.2) allows a remote visitor to append download=1 to a file URL and retrieve files stored in the temporary:// scheme or in a stream wrapper supplied by another module without the access checks that should apply. Files in the public:// and private:// schemes are explicitly not affected, and the supplied data contains no indication of active exploitation; no public exploit identified at time of analysis.