Is CVE-2026-122057 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-122057 being exploited in the wild.

How severe is CVE-2026-122057?

Informational severity, published 4 November 2026.

Which products and versions are affected?

Drupal S3 File System CORS Upload before 1.3.0; Packagist:Https://Packages.Drupal.Org/8 Drupal/S3fs Cors ECOSYSTEM:introduced=0,fixed=1.3.0.

Is there a fix for CVE-2026-122057?

Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/S3fs Cors: upgrade to 1.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-122057 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-122057?

Check whether you run Drupal S3 File System CORS Upload or Packagist:Https://Packages.Drupal.Org/8 Drupal/S3fs Cors at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-122057: Drupal S3 File System CORS Upload access bypass in file deletion

CVE-2026-122057 · Severity: info · Published 2026-11-04

The S3 File System CORS Upload module for Drupal enables direct file uploads to Amazon S3, bypassing PHP size and timeout constraints. A flaw in access controls allows unauthorized users to delete files they should not have permission to access, potentially exposing sensitive data or disrupting file management operations.

Vendors: Drupal, Packagist:Https://Packages.Drupal.Org/8.

Quick answers

Is CVE-2026-122057 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-122057 being exploited in the wild.
How severe is CVE-2026-122057?: Informational severity, published 4 November 2026.
Which products and versions are affected?: Drupal S3 File System CORS Upload before 1.3.0; Packagist:Https://Packages.Drupal.Org/8 Drupal/S3fs Cors ECOSYSTEM:introduced=0,fixed=1.3.0.
Is there a fix for CVE-2026-122057?: Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/S3fs Cors: upgrade to 1.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-122057 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-122057?: Check whether you run Drupal S3 File System CORS Upload or Packagist:Https://Packages.Drupal.Org/8 Drupal/S3fs Cors at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Packagist:Https://Packages.Drupal.Org/8 Drupal/S3fs Cors: upgrade to 1.3.0 or later

Technical details

The module fails to sufficiently validate access permissions for file operations; specifically, the file deletion functionality does not properly check whether a user has authorization to delete a given file. This access bypass is triggered under certain scenarios and allows attackers to delete files beyond their intended permissions. The vulnerability affects all versions prior to 1.3.0.

Affected products

Drupal S3 File System CORS Upload before 1.3.0

Identifiers

CVE-2026-122057
DRUPAL-CONTRIB-2026-295

Timeline

2026-11-04: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.