Live › vulnerability › CVE-2026-107262
Drupal Advanced Filesystem versions up to 1.0.28 have a cross-site request forgery flaw. A malicious web page could make a logged-in user's browser send requests to the site that the user did not intend.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 04:28 UTC. All times on this page are UTC.
Sites running the Drupal Advanced Filesystem module at version 1.0.28 or earlier are listed as affected. The sources do not say which configurations or roles make the flaw reachable.
No product ranges from the sources yet.
composer show drupal/advanced_filesystem or the Extend page)1.0.28; the sources do not name the fixed versionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Advanced Filesystem allows Cross Site Request Forgery. This issue affects Advanced Filesystem versions: from 0.0.0 to 1.0.28.
This page as .md · .json · in your agent: get_signal("CVE-2026-107262")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.