Menu Problem with CiviCRM 5.26.0 in Drupal
Your .htaccess file is incorrect.

It should contain the following content:




# Turn off all options we don't need.
Options -Indexes -ExecCGI -Includes -MultiViews
# Set the catch-all handler to prevent scripts from being executed.
SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
&lt;Files *&gt;
  # Override the handler again if we're run later in the evaluation list.
  SetHandler Drupal_Security_Do_Not_Remove_See_SA_2013_003
&lt;/Files&gt;
# If we know how to do it safely, disable the PHP engine entirely.
&lt;IfModule mod_php5.c&gt;
  php_flag engine off
&lt;/IfModule&gt;



The remaining lines are added ONLY for private file storage, namely these lines:



# Deny all requests from Apache 2.4+.
&lt;IfModule mod_authz_core.c&gt;
  Require all denied
&lt;/IfModule&gt;
# Deny all requests from Apache 2.0-2.2.
&lt;IfModule !mod_authz_core.c&gt;
  Deny from all
&lt;/IfModule&gt;


You should check your Drupal configuration, to ensure that you have a separate folder configured for private file storage, this should be outside your web root.

You should check your configuration against the Drupal documentation here: https://www.drupal.org/docs/7/install/setting-up-the-files-directory