{"id":"CVE-2026-118574","kind":"vulnerability","aliases":["CVE-2026-118574"],"related":[],"title":"Drupal S3 File System: incorrect permissions let attackers reach protected files","description":"Incorrect Permission Assignment for Critical Resource vulnerability in Drupal S3 File System allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects S3 File System versions: from 0.0.0 to 3.12.0.","summary":"The Drupal S3 File System module assigns permissions to a critical resource incorrectly, so access controls can be exploited when the module is configured in certain ways. The sources say versions from 0.0.0 through 3.12.0 are affected, but do not state what an attacker can read or change.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["aws-s3","drupal","package","php","s3fs"],"not_affected_if":["module-version-above-3.12.0"],"how_to_check":"- Check the installed version of the `s3fs` module in the Drupal project (for example with `composer show drupal/s3fs`).\n- Review the module's access and bucket permission settings for the S3 storage.","fix":"- Move the `drupal/s3fs` module past `3.12.0`; the sources do not name the fixed version.","status":"open","published_at":"2026-10-30T04:18:23+00:00","first_seen_at":"2026-10-30T04:28:39+00:00","triaged_at":"2026-10-30T04:29:04+00:00","updated_at":"2026-10-30T04:29:04+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-10-30T04:29:04Z","model":"claude-haiku-5-5","output":{"fix":"- Move the `drupal/s3fs` module past `3.12.0`; the sources do not name the fixed version.","reach":"unknown","title":"Drupal S3 File System: incorrect permissions let attackers reach protected files","impact":"medium","summary":"The Drupal S3 File System module assigns permissions to a critical resource incorrectly, so access controls can be exploited when the module is configured in certain ways. The sources say versions from 0.0.0 through 3.12.0 are affected, but do not state what an attacker can read or change.","audience":"businesses","category":"package","nicknames":[],"who_cares":["drupal","s3fs","php","aws-s3"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown: sources do not say what data is exposed","analyst_note":"Find the NVD or Drupal security advisory for CVE-2026-118574 to confirm the fixed version, the exact misconfiguration and the data exposed.","how_to_check":"- Check the installed version of the `s3fs` module in the Drupal project (for example with `composer show drupal/s3fs`).\n- Review the module's access and bucket permission settings for the S3 storage.\n- unknown for any further check, because the sources do not say which configuration is exposed.","plain_action":"","needs_analyst":true,"not_affected_if":["module-version-above-3.12.0"],"who_is_affected":"Sites running the Drupal S3 File System module at version 3.12.0 or earlier are in the affected range. The sources do not say which configuration is required to be exposed, so unknown whether a default install is affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000709,"input_tokens":4111,"output_tokens":596,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118574':14A,17A '-2026':13A,16A '0.0.0':57B,101C '3.12.0':59B,103C 'access':39B,89C 'affect':61B,95C 'allow':85C 'assign':31B,75C 'attack':8A,68B 'aw':19B 'aws-s3':18B 'certain':50B 'chang':72B 'configur':48B,88C 'control':40B,90C 'critic':35B,77C 'cve':12A,15A 'drupal':1A,21B,26B,81C 'exploit':43B,86C 'file':3A,11A,28B,83C,97C 'incorrect':5A,37B,73C,87C 'issu':94C 'let':7A 'level':92C 'modul':30B,46B 'packag':22B 'permiss':6A,32B,74C 'php':23B 'protect':10A 'reach':9A 'read':70B 'resourc':36B,78C 's3':2A,20B,27B,82C,96C 's3fs':24B 'say':54B 'secur':91C 'sourc':53B 'state':65B 'system':4A,29B,84C,98C 'version':55B,99C 'vulner':79C 'way':51B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Drupal S3 File System module at version 3.12.0 or earlier are in the affected range. The sources do not say which configuration is required to be exposed, so unknown whether a default install is affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T04:18:23+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118574","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118574","severity":null,"published_at":"2026-10-30T04:18:23+00:00","modified_at":"2026-10-30T04:18:23+00:00","first_seen_at":"2026-10-30T04:28:39+00:00","fetched_at":"2026-10-30T04:28:39+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}