Project: 
S3 File System CORS Upload
Project machine name: 
s3fs_cors
Date: 
2026-November-04
Security risk: 
Critical 16 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:All
Vulnerability: 
Access bypass
Affected versions: 
<1.3.0
CVE IDs: 
CVE-2026-122057
Description: 

This module enables you to upload files from the browser directly to Amazon S3 and register them as Drupal files, bypassing normal PHP file size and timeout limits.

The module doesn't sufficiently check access to file uploads. Under certain scenarios, users can delete files they should not have access to.

Solution: 

Install the latest version:

Reported By: 
Fixed By: 
Coordinated By: