CERT24CVE-2026-118574 — S3 File System – Moderately critical – Access bypass – SA-CONTRIB-2026-279Loading data…
CERT24Threat Observatory
Period

CVE-2026-118574 — S3 File System – Moderately critical – Access bypass – SA-CONTRIB-2026-279

The Drupal S3 File System (s3fs) module does not sufficiently isolate the upload context between separate object file operations in the same request. As a result, objects may be uploaded with incorrect access control list (ACL) entries, or corruption may occur through incorrect operation metadata. An attacker must be able to trigger multiple file operations on S3FS. The issue affects versions 0.0.0 through 3.12.0.

← Back to intelligence

CVE-2026-118574 — S3 File System – Moderately critical – Access bypass – SA-CONTRIB-2026-279

The Drupal S3 File System (s3fs) module does not sufficiently isolate the upload context between separate object file operations in the same request. As a result, objects may be uploaded with incorrect access control list (ACL) entries, or corruption may occur through incorrect operation metadata. An attacker must be able to trigger multiple file operations on S3FS. The issue affects versions 0.0.0 through 3.12.0.