DRUPAL-CONTRIB-2026-331: Composer/drupal/download_count vulnerability
This module tracks file downloads for private files and provides reports about them.
The module provides the permissions that are never actually checked. A user with only the View download counts permission could export the download log and delete all download records.
This vulnerability is mitigated by the fact that an attacker must have an account with the View download counts permission.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/download_countto a version that resolves this vulnerability.Fixed in 2.2.5 - Upgrade
Upgrade
composer/drupal/download_countto a version that resolves this vulnerability.Fixed in 3.0.2
Event History
Frequently Asked Questions
Who is exposed to this issue?
Sites using composer/drupal/download_count are exposed if any account has the View download counts permission. The issue requires an authenticated attacker with that permission.
What could a user with only the View download counts permission do?
They could export the download log and delete all download records, despite having only the View download counts permission.
How can I determine whether my site is at risk?
Review permissions for the download count module and identify accounts or roles granted View download counts. Any such account could perform the unauthorized export and deletion actions described.