SA-CONTRIB-2026-331: Critical severity composer/drupal/download_count vulnerability
This module tracks file downloads for private files and provides reports about them. The module provides the permissions that are never actually checked. A user with only the View download counts permission could export the download log and delete all download records. This vulnerability is mitigated by the fact that an attacker must have an account with the View download counts permission.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/download_countto a version that resolves this vulnerability.Fixed in 3.0.2Fixed in 2.2.5
Event History
Frequently Asked Questions
Who is exposed to this issue?
Sites using composer/drupal/download_count are exposed if they have accounts granted the View download counts permission. Exploitation requires an authenticated account with that permission.
What could an attacker do with the View download counts permission?
A user with only that permission could export the download log and delete all download records.