Is CVE-2026-126746 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-126746 being exploited in the wild.

How severe is CVE-2026-126746?

Informational severity, published 11 November 2026.

Which products and versions are affected?

Drupal S3 File System CORS Upload before 1.4.0; Packagist:Https://Packages.Drupal.Org/8 Drupal/S3fs Cors ECOSYSTEM:introduced=0,fixed=1.4.0.

How is CVE-2026-126746 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-126746?

Check whether you run Drupal S3 File System CORS Upload or Packagist:Https://Packages.Drupal.Org/8 Drupal/S3fs Cors at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126746: Drupal S3 File System CORS Upload improper authorization

CVE-2026-126746 · Severity: info · Published 2026-11-11

The S3 File System CORS Upload module allows Drupal users to upload files directly to Amazon S3 buckets through browser-based forms. The module fails to properly restrict what files can be uploaded, allowing authenticated users with access to an upload widget to overwrite files in the S3 bucket that they should not be able to modify. An attacker could use this to replace legitimate files with malicious versions or destroy data.

Vendors: Drupal, Packagist:Https://Packages.Drupal.Org/8.

Quick answers

Is CVE-2026-126746 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-126746 being exploited in the wild.
How severe is CVE-2026-126746?: Informational severity, published 11 November 2026.
Which products and versions are affected?: Drupal S3 File System CORS Upload before 1.4.0; Packagist:Https://Packages.Drupal.Org/8 Drupal/S3fs Cors ECOSYSTEM:introduced=0,fixed=1.4.0.
Is there a fix for CVE-2026-126746?: Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/S3fs Cors: upgrade to 1.4.0 or later. Until then: Restrict access to entity forms that use the S3 File System CORS Upload widget to only trusted users who require file upload functionality, limiting the user population that can exploit this vulnerability. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-126746 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-126746?: Check whether you run Drupal S3 File System CORS Upload or Packagist:Https://Packages.Drupal.Org/8 Drupal/S3fs Cors at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Packagist:Https://Packages.Drupal.Org/8 Drupal/S3fs Cors: upgrade to 1.4.0 or later

Restrict access to entity forms that use the S3 File System CORS Upload widget to only trusted users who require file upload functionality, limiting the user population that can exploit this vulnerability.

Technical details

The vulnerability is an improper authorization flaw in the S3 File System CORS Upload module's handling of browser-based S3 uploads. Authenticated users who can access a form using the module's upload widget can overwrite arbitrary files in the configured S3 bucket due to insufficient permission checks on the upload policy. The attack requires the attacker to have legitimate access to a form that uses the vulnerable widget component.

Affected products

Drupal S3 File System CORS Upload before 1.4.0

Identifiers

CVE-2026-126746
DRUPAL-CONTRIB-2026-337

Timeline

2026-11-11: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.