Live › vulnerability › CVE-2026-118574
The Drupal S3 File System module assigns permissions to a critical resource incorrectly, so access controls can be exploited when the module is configured in certain ways. The sources say versions from 0.0.0 through 3.12.0 are affected, but do not state what an attacker can read or change.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 04:28 UTC. All times on this page are UTC.
Sites running the Drupal S3 File System module at version 3.12.0 or earlier are in the affected range. The sources do not say which configuration is required to be exposed, so unknown whether a default install is affected.
No product ranges from the sources yet.
s3fs module in the Drupal project (for example with composer show drupal/s3fs).drupal/s3fs module past 3.12.0; the sources do not name the fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Incorrect Permission Assignment for Critical Resource vulnerability in Drupal S3 File System allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects S3 File System versions: from 0.0.0 to 3.12.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-118574")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.