Eirik Morland
--- a/core/modules/image/image.module
+++ b/core/modules/image/image.module
  if (str_starts_with($path, 'styles/')) {
    $args = explode('/', $path);

-    // Discard "styles", style name, and scheme from the path
+    // Discard "styles", style name, and scheme from the path.
--- a/core/modules/image/src/ImageFieldManager.php 0 → 100644
+++ b/core/modules/image/src/ImageFieldManager.php 0 → 100644
+   *   ]
+   * @code
+   */
+  public function getDefaultImageFields() : array {
+    $cid = 'image:default_images';
+    if (!isset($this->cachedDefaults)) {
+      $cache = $this->cache->get($cid);
+      if ($cache) {
+        $this->cachedDefaults = $cache->data;
+      }
+      else {
+        // Save a map of all default image UUIDs and their corresponding field
+        // configuration IDs for quick lookup.
+        $defaults = [];
+        $fields = $this->entityTypeManager
+          ->getStorage('field_config')
--- a/core/modules/image/src/ImageFieldManager.php 0 → 100644
+++ b/core/modules/image/src/ImageFieldManager.php 0 → 100644
+   * an image stored in the private file storage.
+   *
+   * @return array
+   *   An associative array, where the keys are image file URIs, and the values
+   *   are arrays of field configuration IDs which use that image file as their
+   *   default image. For example,
+   *
+   * @code [
+   *     'private://default_images/astronaut.jpg' => [
+   *       'node.article.field_image',
+   *       'user.user.field_portrait',
+   *     ],
+   *   ]
+   * @code
+   */
+  public function getDefaultImageFields() : array {
--- a/core/modules/image/src/ImageFieldManager.php 0 → 100644
+++ b/core/modules/image/src/ImageFieldManager.php 0 → 100644
+<?php
+
+namespace Drupal\image;
+
+use Drupal\Core\Cache\CacheBackendInterface;
+use Drupal\Core\Entity\EntityRepositoryInterface;
+use Drupal\Core\Entity\EntityTypeManagerInterface;
+use Drupal\file\FileInterface;
+
+/**
+ * Provides a service for managing image fields.
+ */
+class ImageFieldManager {
--- a/core/modules/image/src/ImageFieldManager.php 0 → 100644
+++ b/core/modules/image/src/ImageFieldManager.php 0 → 100644
+            // Field storage config can also have a default image.
+            $storage_uuid = $field->getFieldStorageDefinition()->getSetting('default_image')['uuid'];
+            if ($storage_uuid) {
+              $file = $this->entityRepository->loadEntityByUuid('file', $storage_uuid);
+              if ($file instanceof FileInterface) {
+                // Use the field config id since that is what we'll be using to
+                // check access in image_file_download().
+                $defaults[$file->getFileUri()][] = $field->get('id');
+              }
+            }
+          }
+        }
+
+        // Cache the default image list.
+        $this->cache
+          ->set($cid, $defaults, CacheBackendInterface::CACHE_PERMANENT, ['image_default_images']);
--- a/core/modules/image/image.module
+++ b/core/modules/image/image.module
+  // Default images are displayed as a fallback when an image is not uploaded to
+  // an image field.
+  if (strpos($path, 'default_images/') === 0) {
+    $image = \Drupal::service('image.factory')->get($uri);
+    $user = \Drupal::currentUser();
+    /** @var Drupal\image\ImageFieldManager $image_field_service */
+    $image_field_service = \Drupal::service('image.field_manager');
+    $default_images = $image_field_service->getDefaultImageFields();
+    $has_access = FALSE;
+
+    // If the image being requested for download is being used as the default
+    // image for any fields, then grant access if the user has 'view' access to
+    // at least one of those fields.
+    if (isset($default_images[$uri])) {
+      foreach ($default_images[$uri] as $field_config_id) {
+        $field = \Drupal::entityTypeManager()
--- a/core/modules/image/src/ImageFieldManager.php 0 → 100644
+++ b/core/modules/image/src/ImageFieldManager.php 0 → 100644
+   *
+   * @var \Drupal\Core\Cache\CacheBackendInterface
+   */
+  protected CacheBackendInterface $cache;
+
+  /**
+   * The entity type manager.
+   *
+   * @var \Drupal\Core\Entity\EntityTypeManagerInterface
+   */
+  protected EntityTypeManagerInterface $entityTypeManager;
+
+  /**
+   * The entity repository.
+   *
+   * @var \Drupal\Core\Entity\EntityRepositoryInterface
--- a/core/modules/image/image.module
+++ b/core/modules/image/image.module
+        $field = \Drupal::entityTypeManager()
+          ->getStorage('field_config')
+          ->load($field_config_id);
+        $field_definition = $field->getItemDefinition()->getFieldDefinition();
+        $access_control_handler = \Drupal::entityTypeManager()
+          ->getAccessControlHandler($field->get('entity_type'));
+
+        if ($has_access = $access_control_handler->fieldAccess('view', $field_definition, $user)) {
+          // As long as the user has view access to at least one of the fields,
+          // that uses this image as a default, we can exit this foreach loop,
+          // and grant access.
+          break;
+        }
+      }
+    }
+    if ($image->isValid() && $has_access) {
--- a/core/modules/image/tests/src/Functional/ImageFieldDisplayTest.php
+++ b/core/modules/image/tests/src/Functional/ImageFieldDisplayTest.php
    // Default private image should be displayed when no user supplied image
    // is present.
    $this->assertSession()->responseContains($default_output);
+
+    // Check that the default image itself can be downloaded; i.e.: not just the
+    // HTML markup.
+    $urlForPrivateDefaultImageInNodeField = \Drupal::service('file_url_generator')->generateAbsoluteString($file->getFileUri());
--- a/core/modules/image/image.module
+++ b/core/modules/image/image.module
    return -1;
  }

+  // Private file access for image fields' default images.
+  // Default images are displayed as a fallback when an image is not uploaded to
+  // an image field.
--- a/core/modules/image/src/ImageFieldManagerInterface.php 0 → 100644
+++ b/core/modules/image/src/ImageFieldManagerInterface.php 0 → 100644
+use Drupal\Core\Access\AccessResultInterface;
+use Drupal\Core\Image\ImageInterface;
+use Drupal\Core\Session\AccountInterface;
+
+/**
+ * Provides an interface for an image field manager.
+ */
+interface ImageFieldManagerInterface {
+
+  /**
+   * The default image directory.
+   */
+  public const string DEFAULT_IMAGE_DIRECTORY = 'default_images';
+
+  /**
+   * Map default values for image fields, and those fields' definitions.
-   * Map default values for image fields, and those fields' definitions.
+   * Maps default values for image fields, and those fields' definitions.
--- a/core/modules/image/src/ImageFieldManagerInterface.php 0 → 100644
+++ b/core/modules/image/src/ImageFieldManagerInterface.php 0 → 100644
+   * The default image directory.
+   */
+  public const string DEFAULT_IMAGE_DIRECTORY = 'default_images';
+
+  /**
+   * Map default values for image fields, and those fields' definitions.
+   *
+   * @return array<string, \Drupal\Core\Field\FieldDefinitionInterface[]>
+   *   An associative array, where the keys are image file URIs, and the values
+   *   are arrays of field definitions which use that image file as their
+   *   default image.
+   */
+  public function getDefaultImageFields(): array;
+
+  /**
+   * Check access to a default image.
-   * Check access to a default image.
+   * Checks the access to a default image.
--- a/core/modules/image/image.module
+++ b/core/modules/image/image.module
    return -1;
  }

+  // Private file access for image fields' default images.
+  // Default images are displayed as a fallback when an image is not uploaded to
+  // an image field.
-  // Private file access for image fields' default images.
-  // Default images are displayed as a fallback when an image is not uploaded to
-  // an image field.
+  // Private file access for image fields' default images. Default images are
+  // displayed as a fallback when an image is not uploaded to an image field.
--- a/core/modules/image/image.module
+++ b/core/modules/image/image.module
    return -1;
  }

+  // Private file access for image fields' default images.
+  // Default images are displayed as a fallback when an image is not uploaded to
+  // an image field.
+  if (str_starts_with($path, ImageFieldManagerInterface::DEFAULT_IMAGE_DIRECTORY . '/')) {
-  if (str_starts_with($path, ImageFieldManagerInterface::DEFAULT_IMAGE_DIRECTORY . '/')) {
+  if (str_starts_with($path, ImageFieldManagerInterface::DEFAULT_IMAGE_DIRECTORY . DIRECTORY_SEPARATOR)) {
--- a/core/modules/image/src/ImageFieldManager.php 0 → 100644
+++ b/core/modules/image/src/ImageFieldManager.php 0 → 100644
+      $cid = 'image:default_images';
+      if ($cache = $this->cache->get($cid)) {
+        $this->cachedDefaults = $cache->data;
+      }
+      else {
+        // Save a map of all default image UUIDs and their corresponding field
+        // definitions for quick lookup.
+        $defaults = [];
+        $field_map = $this->entityFieldManager->getFieldMapByFieldType('image');
+        $cache_tags = [
+          'image_default_images',
+          'entity_field_info',
+        ];
+        foreach ($field_map as $entity_type_id => $fields) {
+          $field_storages = $this->entityFieldManager->getFieldStorageDefinitions($entity_type_id);
+          foreach ($fields as $field_name => $field_info) {
--- a/core/modules/image/src/Hook/ImageDownloadFileHook.php 0 → 100644
+++ b/core/modules/image/src/Hook/ImageDownloadFileHook.php 0 → 100644
+use Drupal\Core\Entity\EntityRepositoryInterface;
+use Drupal\Core\Entity\EntityTypeManagerInterface;
+use Drupal\Core\Extension\ModuleHandlerInterface;
+use Drupal\Core\Hook\Attribute\Hook;
+use Drupal\Core\Image\ImageFactory;
+use Drupal\Core\Session\AccountInterface;
+use Drupal\Core\StreamWrapper\StreamWrapperManager;
+use Drupal\image\Controller\ImageStyleDownloadController;
+use Drupal\image\Plugin\Field\FieldType\ImageItem;
+use Symfony\Component\DependencyInjection\Attribute\Autowire;
+
+/**
+ * Implements hook_file_download().
+ */
+#[Hook('file_download')]
+class ImageDownloadFileHook {
--- a/core/modules/image/tests/modules/image_field_display_test_default_private_storage/image_field_display_test_default_private_storage.module 0 → 100644
+++ b/core/modules/image/tests/modules/image_field_display_test_default_private_storage/image_field_display_test_default_private_storage.module 0 → 100644
+ * @file
+ * Image field display test for default images in private file storage.
+ */
+
+declare(strict_types=1);
+
+use Drupal\Core\Access\AccessResultInterface;
+use Drupal\Core\Field\FieldDefinitionInterface;
+use Drupal\Core\Session\AccountInterface;
+use Drupal\Core\Field\FieldItemListInterface;
+use Drupal\Core\Access\AccessResult;
+
+/**
+ * Implements hook_entity_field_access().
+ */
+function image_field_display_test_default_private_storage_entity_field_access($operation, FieldDefinitionInterface $field_definition, AccountInterface $account, ?FieldItemListInterface $items = NULL): AccessResultInterface {
--- a/core/modules/image/src/Hook/ImageDownloadFileHook.php 0 → 100644
+++ b/core/modules/image/src/Hook/ImageDownloadFileHook.php 0 → 100644
+
+/**
+ * Implements hook_file_download().
+ */
+#[Hook('file_download')]
+class ImageDownloadFileHook {
+
+  /**
+   * Cache for private default images.
+   *
+   * @var array<string, \Drupal\Core\Field\FieldDefinitionInterface[]>
+   */
+  protected array $cachedPrivateDefaultImages;
+
+  public function __construct(
+    #[Autowire(service: 'cache.default')]