DRUPAL-CONTRIB-2026-295: Composer/drupal/s3fs_cors vulnerability
This module enables you to upload files from the browser directly to Amazon S3 and register them as Drupal files, bypassing normal PHP file size and timeout limits.
The module doesn't sufficiently check access to file uploads. Under certain scenarios, users can delete files they should not have access to.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/s3fs_corsto a version that resolves this vulnerability.Fixed in 1.3.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Drupal sites using the composer/drupal/s3fs_cors module are exposed under the scenarios where its upload access checks are insufficient. The issue can allow users to delete files they should not be permitted to access.
What access does an attacker need?
The available information indicates that a user must be able to reach the affected file-upload functionality. It does not specify whether anonymous users, authenticated users, or particular roles are required.
Are default configurations affected?
The issue is described as occurring only under certain scenarios. The provided information does not identify whether the module's default configuration is among the affected scenarios.