# CVE-2026-122057: Drupal S3 File System CORS Upload access bypass in file deletion

Source: https://junglewise.ai/threats/cve-2026-122057-drupal-contrib-2026-295-this-module-enables-you-to-upload-files  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-04. Updated: 2026-11-06  
License: CC BY 4.0 with a link back

CVE-2026-122057 · Severity: info · Published 2026-11-04

The S3 File System CORS Upload module for Drupal enables direct file uploads to Amazon S3, bypassing PHP size and timeout constraints. A flaw in access controls allows unauthorized users to delete files they should not have permission to access, potentially exposing sensitive data or disrupting file management operations.

Vendors: [Drupal](https://junglewise.ai/threats/vendors/drupal), [Packagist:Https://Packages.Drupal.Org/8](https://junglewise.ai/threats/vendors/packagist-https-packages-drupal-org-8).

## Quick answers

**Is CVE-2026-122057 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-122057 being exploited in the wild.

**How severe is CVE-2026-122057?** Informational severity, published 4 November 2026.

**Which products and versions are affected?** Drupal S3 File System CORS Upload before 1.3.0; Packagist:Https://Packages.Drupal.Org/8 Drupal/S3fs Cors ECOSYSTEM:introduced=0,fixed=1.3.0.

**Is there a fix for CVE-2026-122057?** Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/S3fs Cors: upgrade to 1.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-122057 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-122057?** Check whether you run Drupal S3 File System CORS Upload or Packagist:Https://Packages.Drupal.Org/8 Drupal/S3fs Cors at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Packagist:Https://Packages.Drupal.Org/8 Drupal/S3fs Cors: upgrade to 1.3.0 or later

## Technical details

The module fails to sufficiently validate access permissions for file operations; specifically, the file deletion functionality does not properly check whether a user has authorization to delete a given file. This access bypass is triggered under certain scenarios and allows attackers to delete files beyond their intended permissions. The vulnerability affects all versions prior to 1.3.0.

## Affected products

- Drupal S3 File System CORS Upload before 1.3.0

## Identifiers

- CVE-2026-122057
- DRUPAL-CONTRIB-2026-295

## Timeline

- 2026-11-04: disclosed

## References

- [https://www.drupal.org/u/heddn](https://www.drupal.org/u/heddn)
- [https://www.drupal.org/sa-contrib-2026-295](https://www.drupal.org/sa-contrib-2026-295)

## Related threats

- [Drupal S3 File System CORS Upload improper authorization](https://junglewise.ai/threats/cve-2026-126746-drupal-contrib-2026-337-the-s3-file-system-cors-upload-module)