SA-CONTRIB-2026-295: Critical severity composer/drupal/s3fs_cors vulnerability

Q: Who is exposed to unauthorized file deletion?

Sites using composer/drupal/s3fs_cors may be exposed under certain scenarios because the module does not sufficiently check access to file uploads. The provided information does not identify the specific roles, permissions, or configurations that trigger the issue.

Q: What does an attacker need to exploit this issue?

The issue concerns insufficient access checks for file uploads and can allow users to delete files they should not be able to access under certain scenarios. The provided information does not state whether authentication, a particular permission, or a specific upload workflow is required.

Q: Are default installations affected?

The available information does not say whether the vulnerable conditions exist in a default configuration. Exposure depends on the unspecified scenarios in which the module's upload access checks are insufficient.

Published Nov 4, 2026

Updated

This module enables you to upload files from the browser directly to Amazon S3 and register them as Drupal files, bypassing normal PHP file size and timeout limits. The module doesn't sufficiently check access to file uploads. Under certain scenarios, users can delete files they should not have access to.

Credit

Lucas Hedding (heddn)

Affected Software

1 affected componentFixes available

composer/drupal/s3fs_cors<8.x-1.3

8.x-1.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade composer/drupal/s3fs_cors to a version that resolves this vulnerability.
Fixed in 8.x-1.3

Event History

Nov 4, 2026

Advisory Published

via Drupal·12:00 AM

Data Sourced

via Drupal·12:00 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-122057

Frequently Asked Questions

Who is exposed to unauthorized file deletion?

Sites using composer/drupal/s3fs_cors may be exposed under certain scenarios because the module does not sufficiently check access to file uploads. The provided information does not identify the specific roles, permissions, or configurations that trigger the issue.

What does an attacker need to exploit this issue?

The issue concerns insufficient access checks for file uploads and can allow users to delete files they should not be able to access under certain scenarios. The provided information does not state whether authentication, a particular permission, or a specific upload workflow is required.

Are default installations affected?

The available information does not say whether the vulnerable conditions exist in a default configuration. Exposure depends on the unspecified scenarios in which the module's upload access checks are insufficient.

SA-CONTRIB-2026-295: Critical severity composer/drupal/s3fs_cors vulnerability

Credit

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Who is exposed to unauthorized file deletion?

What does an attacker need to exploit this issue?

Are default installations affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to unauthorized file deletion?

What does an attacker need to exploit this issue?

Are default installations affected?