View online: https://www.drupal.org/sa-contrib-2026-295 Project: S3 File System CORS Upload [1] Project machine name: s3fs_cors Date: 2026-November-04 Security risk: *Critical* 16 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <1.3.0 CVE IDs: CVE-2026-122057 Description: This module enables you to upload files from the browser directly to Amazon S3 and register them as Drupal files, bypassing normal PHP file size and timeout limits. The module doesn't sufficiently check access to file uploads. Under certain scenarios, users can delete files they should not have access to. Solution: Install the latest version: * Upgrade to S3 File System CORS Upload 8.x-1.3 [3]. Reported By: * Lucas Hedding (heddn) [4] Fixed By: * Lucas Hedding (heddn) [5] * James Scott (jayelless) [6] Coordinated By: * Swan Kalata (akalata) [7] of the Drupal Security Team * Greg Knaddison (greggles) [8] of the Drupal Security Team * Juraj Nemec (poker10) [9] of the Drupal Security Team * Jess (xjm) [10] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [11] [1] https://www.drupal.org/project/s3fs_cors [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/s3fs_cors/releases/8.x-1.3 [4] https://www.drupal.org/u/heddn [5] https://www.drupal.org/u/heddn [6] https://www.drupal.org/u/jayelless [7] https://www.drupal.org/u/akalata [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/poker10 [10] https://www.drupal.org/u/xjm [11] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal....