---
id: "CVE-2026-118574"
kind: "vulnerability"
aliases: ["CVE-2026-118574"]
title: "Drupal S3 File System: incorrect permissions let attackers reach protected files"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["aws-s3", "drupal", "package", "php", "s3fs"]
not_affected_if: ["module-version-above-3.12.0"]
published_at: "2026-10-30T04:18:23+00:00"
first_seen_at: "2026-10-30T04:28:39+00:00"
updated_at: "2026-10-30T04:29:04+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118574", "first_seen_at": "2026-10-30T04:28:39+00:00"}]
---

# Drupal S3 File System: incorrect permissions let attackers reach protected files

The Drupal S3 File System module assigns permissions to a critical resource incorrectly, so access controls can be exploited when the module is configured in certain ways. The sources say versions from 0.0.0 through 3.12.0 are affected, but do not state what an attacker can read or change.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the `s3fs` module in the Drupal project (for example with `composer show drupal/s3fs`).
- Review the module's access and bucket permission settings for the S3 storage.

## Fix

- Move the `drupal/s3fs` module past `3.12.0`; the sources do not name the fixed version.

## Timeline

- 2026-10-30T04:28:39+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118574

## From the sources

Incorrect Permission Assignment for Critical Resource vulnerability in Drupal S3 File System allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects S3 File System versions: from 0.0.0 to 3.12.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_