—
DRUPAL-CONTRIB-2026-020
Details
This module moves files to and from private storage depending on the access of its owning entities. The module does not sufficiently incorporate the results of hook\_file\_download when a custom or contrib module implements that hook leading to access bypass.
Are you affected?
Enter the version of the package you're using.
Affected packages
Packagist:https://packages.drupal.org/8/drupal/file_access_fix
Introduced in:
0Fixed in: 1.2.0Upgrade drupal/file_access_fix to 1.2.0 or newer (ecosystem packagist:https://packages.drupal.org/8).