CVE-2026-122057 json
This module enables you to upload files from the browser directly to Amazon S3 and register them as Drupal files, bypassing normal PHP file…
published 2026-11-04 4 d ago modified 2026-11-04 4 d ago also DRUPAL-CONTRIB-2026-295
- cvss
- —
- not scored
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- —
- no EPSS score yet
- public exploits
- 0
- none known
Summary
This module enables you to upload files from the browser directly to Amazon S3 and register them as Drupal files, bypassing normal PHP file size and timeout limits.
The module doesn't sufficiently check access to file uploads. Under certain scenarios, users can delete files they should not have access to.
Patch / fix
- packagist drupal/s3fs_cors 1.3.0
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | drupal/s3fs_cors | <1.3.0 |
1.3.0 |
References
Sources
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.