CVE-2026-3525
This module moves files to and from private storage depending on the access of its owning entities. The module does not sufficiently incorporate the...
Original description
The description as published by the source.
This module moves files to and from private storage depending on the access of its owning entities.
The module does not sufficiently incorporate the results of hook_file_download when a custom or contrib module implements that hook leading to access bypass.
Affected packages
Packagist:https://packages.drupal.org/8
drupal/file_access_fix
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0"}],"database_specific":{"constraint":"<1.2.0"}}]
References
- web drupal.org