Is CVE-2026-126747 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-126747 being exploited in the wild.

How severe is CVE-2026-126747?

Informational severity, published 11 November 2026.

Which products and versions are affected?

Drupal File Resumable Upload before 2.0.6; Packagist:Https://Packages.Drupal.Org/8 Drupal/File Resup ECOSYSTEM:introduced=0,fixed=2.0.6.

Is there a fix for CVE-2026-126747?

Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/File Resup: upgrade to 2.0.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-126747 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-126747?

Check whether you run Drupal File Resumable Upload or Packagist:Https://Packages.Drupal.Org/8 Drupal/File Resup at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126747: Drupal File Resumable Upload improper authorization in upload forms

CVE-2026-126747 · Severity: info · Published 2026-11-11

The File Resumable Upload module for Drupal extends file and image upload capabilities. An unauthenticated attacker can bypass access controls on resumable upload forms and store partial upload data on the server. The impact is limited because the partial data cannot be finalized without passing through additional access-controlled forms, and the uploaded data itself cannot be executed by the web server.

Vendors: Drupal, Packagist:Https://Packages.Drupal.Org/8.

Quick answers

Is CVE-2026-126747 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-126747 being exploited in the wild.
How severe is CVE-2026-126747?: Informational severity, published 11 November 2026.
Which products and versions are affected?: Drupal File Resumable Upload before 2.0.6; Packagist:Https://Packages.Drupal.Org/8 Drupal/File Resup ECOSYSTEM:introduced=0,fixed=2.0.6.
Is there a fix for CVE-2026-126747?: Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/File Resup: upgrade to 2.0.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-126747 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-126747?: Check whether you run Drupal File Resumable Upload or Packagist:Https://Packages.Drupal.Org/8 Drupal/File Resup at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Packagist:Https://Packages.Drupal.Org/8 Drupal/File Resup: upgrade to 2.0.6 or later

Technical details

The module fails to properly authorize access to resumable upload form handlers, allowing unauthenticated users to initiate uploads and accumulate partial upload data on disk. The vulnerability requires no authentication or user interaction beyond a direct web request. While an attacker can store partial uploads, the data cannot be attached to content or executed without passing through entity forms that enforce their own access controls.

Affected products

Drupal File Resumable Upload before 2.0.6

Identifiers

CVE-2026-126747
DRUPAL-CONTRIB-2026-338

Timeline

2026-11-11: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.