drupal-contrib-2026-295

{
  "affected": [
    {
      "database_specific": {
        "affected_versions": "<1.3.0",
        "source": "https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/s3fs_cors/DRUPAL-CONTRIB-2026-295.json"
      },
      "package": {
        "ecosystem": "Packagist:https://packages.drupal.org/8",
        "name": "drupal/s3fs_cors",
        "purl": "pkg:composer/drupal/s3fs_cors?repository_url=https:%2F%2Fpackages.drupal.org%2F8"
      },
      "ranges": [
        {
          "database_specific": {
            "constraint": "<1.3.0"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.3.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-122057"
  ],
  "credits": [
    {
      "contact": [
        "https://www.drupal.org/u/heddn"
      ],
      "name": "Lucas Hedding (heddn)"
    }
  ],
  "details": "This module enables you to upload files from the browser directly to Amazon S3 and register them as Drupal files, bypassing normal PHP file size and timeout limits.\n\nThe module doesn't sufficiently check access to file uploads. Under certain scenarios, users can delete files they should not have access to.",
  "id": "DRUPAL-CONTRIB-2026-295",
  "modified": "2026-11-04T20:30:04.245191611Z",
  "published": "2026-11-04T17:30:52Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://www.drupal.org/sa-contrib-2026-295"
    }
  ],
  "schema_version": "1.9.2"
}