DRUPAL-CONTRIB-2026-020
NoneCVSS
—
EPSS
—
Published
Mar 4, 2026
CISA due date
—
The record
This module moves files to and from private storage depending on the access of its owning entities. The module does not sufficiently incorporate the results of hook\_file\_download when a custom or contrib module implements that hook leading to access bypass.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist:https://packages.drupal.org/8 | drupal/file_access_fix | 0 | 1.2.0 |
Related vulnerabilities
- CVE-2026-3525 Incorrect Authorization vulnerability in Drupal File Access Fix (deprecated) allows… Same vulnerability
- CVE-2026-3526 Incorrect Authorization vulnerability in Drupal File Access Fix (deprecated) allows… Also affects drupal/file_access_fix
- DRUPAL-CONTRIB-2026-021 This module moves files to and from private storage depending on the access of its owning… Also affects drupal/file_access_fix