CVE-2026-122057: Composer/drupal/s3fs_cors vulnerability
This module enables you to upload files from the browser directly to Amazon S3 and register them as Drupal files, bypassing normal PHP file size and timeout limits.
The module doesn't sufficiently check access to file uploads. Under certain scenarios, users can delete files they should not have access to.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/s3fs_corsto a version that resolves this vulnerability.Fixed in 1.3.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Drupal sites using this module are exposed where the affected access-control scenarios are present. The issue involves users being able to delete files they should not be permitted to delete.
What does an attacker need to exploit it?
An attacker needs access as a user in one of the scenarios where the module does not sufficiently enforce file-upload access controls. The provided information does not specify the required role, permission, or configuration.
How can I determine whether my site is affected?
Verify whether the module is installed and used for direct browser uploads to Amazon S3 that are registered as Drupal files. Then review whether users can reach upload or file-management workflows beyond the files they are authorized to manage.