CVE-2026-122057
CVE-2026-122057 is a vulnerability with no CVSS score yet in drupal/s3fs_cors, published November 4, 2026. No source lists public exploit code. Fixed in drupal/s3fs_cors 1.3.0.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1.3.0drupal/s3fs_cors
Description
This module enables you to upload files from the browser directly to Amazon S3 and register them as Drupal files, bypassing normal PHP file size and timeout limits.
The module doesn't sufficiently check access to file uploads. Under certain scenarios, users can delete files they should not have access to.
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal/s3fs_corsPackagist:https://packages.drupal.org/8 | before 1.3.0 | 1.3.0 |
What each source reports
OSVDRUPAL-CONTRIB-2026-295No score
This module enables you to upload files from the browser directly to Amazon S3 and register them as Drupal files, bypassing normal PHP file size and timeout limits.
The module doesn't sufficiently check access to file uploads. Under certain scenarios, users can delete files they should not have access to.
- Record
DRUPAL-CONTRIB-2026-295- Updated
- 2026-11-04
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.