Project: 
Advanced Filesystem
Project machine name: 
advanced_filesystem
Date: 
2026-October-07
Security risk: 
Moderately critical 12 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:Default
Vulnerability: 
Cross-Site Request Forgery
Affected versions: 
<1.0.28
CVE IDs: 
CVE-2026-107262
Description: 

Advanced File System turns Drupal's file storage into a manageable, observable and maintainable subsystem.

The Advanced Filesystem: Backup submodule does not sufficiently validate certain requests. This may allow an attacker to trick an authenticated user into performing unintended actions through a Cross-Site Request Forgery (CSRF) vulnerability.

The vulnerability is mitigated by the fact that advanced_filesystem_backup module must be enabled.

Solution: 

Install the latest version:

Reported By: 
Fixed By: 
Coordinated By: