Description
This module enables you to upload files from the browser directly to Amazon S3 and register them as Drupal files, bypassing normal PHP file size and timeout limits.
The module doesn't sufficiently check access to file uploads. Under certain scenarios, users can delete files they should not have access to.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | drupal/s3fs_cors | < 1.3.0 | 1.3.0 | DRUPAL-CONTRIB-2026-295 |
Advisories 1
- WID-SEC-2026-4352 Drupal Erweiterungen: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 4, 2026