SA-CONTRIB-2026-217: CSRF

Q: Who is exposed to this vulnerability?

Sites are exposed only if the advanced_filesystem_backup submodule is enabled. Exploitation also requires an authenticated user to be tricked into sending a crafted request.

Q: What does an attacker need to exploit it?

An attacker needs to induce an authenticated user to perform a request that triggers an unintended action. The available information identifies this as a CSRF issue caused by insufficient validation of certain requests.

Published Oct 7, 2026

Updated

Advanced File System turns Drupal's file storage into a manageable, observable and maintainable subsystem. The Advanced Filesystem: Backup submodule does not sufficiently validate certain requests. This may allow an attacker to trick an authenticated user into performing unintended actions through a Cross-Site Request Forgery (CSRF) vulnerability. The vulnerability is mitigated by the fact that advancedfilesystembackup module must be enabled.

Credit

Marcus Johansson (marcus_johansson)

Affected Software

1 affected componentFixes available

drupal/advanced_filesystem<1.0.28

1.0.28

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade drupal/advanced_filesystem to a version that resolves this vulnerability.
Fixed in 1.0.28

Event History

Oct 7, 2026

Advisory Published

via Drupal·12:00 AM

Data Sourced

via Drupal·12:00 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-107262

Frequently Asked Questions

Who is exposed to this vulnerability?

Sites are exposed only if the advanced_filesystem_backup submodule is enabled. Exploitation also requires an authenticated user to be tricked into sending a crafted request.

What does an attacker need to exploit it?

An attacker needs to induce an authenticated user to perform a request that triggers an unintended action. The available information identifies this as a CSRF issue caused by insufficient validation of certain requests.

SA-CONTRIB-2026-217: CSRF

Credit

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Who is exposed to this vulnerability?

What does an attacker need to exploit it?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this vulnerability?

What does an attacker need to exploit it?