Threats tagged 'ghsa-wc74-vwp5-gqfv'

The File Force Download module for Drupal 7 improperly grants access to files in certain schemes by returning Content-Disposition headers without proper access checks. Specifically, versions 7.1.0 through 7.1.2 allow unauthenticated users to download files in the temporary:// scheme or other stream wrappers by appending a download=1 parameter to the file URL. Public and private scheme files are not affected.