CVE-2026-110176

Vendor

Drupal

Product

File Force Download

CVSS v4.0

8.7 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness

CWE-863

Exposure class

Web platform

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

1. 21
   CVE NVD 2d ago

   The File Force Download module for Drupal 7 implements hook_file_download() to add a Content-Disposition header when a file URL carries the download…

   The File Force Download module for Drupal 7 implements hook_file_download() to add a Content-Disposition header when a file URL carries the download query parameter. In Drupal 7, returning a non-empty header array from that hook…

   CVSS 8.7 CVE-2026-110176 Drupal