it-securitynotifies AT lists.piratenpartei.de

Betreff: Sicherheitsankündigungen

Listenarchiv

[IT-SecNots] [Security-news] S3 File System CORS Upload - Critical - Access bypass - SA-CONTRIB-2026-295

From: security-news AT drupal.org
To: security-news AT drupal.org
Subject: [IT-SecNots] [Security-news] S3 File System CORS Upload - Critical - Access bypass - SA-CONTRIB-2026-295
Date: Wed, 4 Nov 2026 17:30:53 +0000
Arc-authentication-results: i=2; smtp1.osuosl.org; dmarc=pass header.from=drupal.org; dkim=pass header.d=drupal.org header.i= AT drupal.org header.a=rsa-sha256 header.s=h2cwj55irf2bug4gly7tdskg3xbjhlg6 header.b=pQ9VmDI1; dkim=pass header.d=amazonses.com header.i= AT amazonses.com header.a=rsa-sha256 header.s=hsbnp7p3ensaochzwyq5wwmceodymuwv header.b="sbN3rl/R"; arc=fail smtp.remote-ip=140.211.10.49
Arc-authentication-results: i=1; smtp1.osuosl.org; dmarc=pass header.from=drupal.org; dkim=pass header.d=drupal.org header.i= AT drupal.org header.a=rsa-sha256 header.s=h2cwj55irf2bug4gly7tdskg3xbjhlg6 header.b=pQ9VmDI1; dkim=pass header.d=amazonses.com header.i= AT amazonses.com header.a=rsa-sha256 header.s=hsbnp7p3ensaochzwyq5wwmceodymuwv header.b="sbN3rl/R"; arc=none smtp.remote-ip=54.240.27.115
Arc-filter: OpenARC Filter v1.3.2 smtp1.osuosl.org C5E538119C
Arc-filter: OpenARC Filter v1.3.2 smtp1.osuosl.org 8400A80BED
Arc-message-signature: i=2; d=osuosl.org; s=arc; a=rsa-sha256; c=relaxed/relaxed; t=1793815409; h=X-Comment:DKIM-Signature:Received:X-Spam-Flag:X-Spam-Score: X-Spam-Level:X-Spam-Status:ARC-Filter:Received-SPF:DKIM-Signature: DKIM-Signature:Date:To:MIME-Version:Feedback-ID:X-Mailman-Rule-Hits: X-Mailman-Rule-Misses:Message-ID-Hash:X-Mailman-Approved-At: Message-ID:From:X-Mailman-Version:Precedence:Reply-To:Subject:List-Id: Archived-At:List-Archive:List-Help:List-Owner:List-Post: List-Subscribe:List-Unsubscribe:Content-Type: Content-Transfer-Encoding; bh=X6nUc++Ej8dtI2d0F0Ektd6LeojuOcckC7MKs+iciD0=; b=HV2UoYrfcU5iidvsCPL4wuqJOhQWpse6S8Z0xqo6TnGQo6r6dySf5FSx0roaawNGh5f6 yEwFRsMHI1NLI2QEhB56IrveIYV5oCQAnlw5lTsswE0lyuZrc0WIcOMbzEH/O5dTLqeS4 ZpdBAN9wEYxrhLQ3H53AAqgMq/siL9PlJZp89ovdSVS2OsMC8oBnpPpN4y7QkwsOYMoZE Q55tj66xEUN9Yki1fq0H9y+t6jXX8Q1T3ACpr73SoLBv+j3nZ5/Sqz7aNuWvIqHe4cFuv P39y1CBCFmWvtzr0fJ0x4EQ3crsjKiuRpLE5OGwVPnqFF1zjT1NK+EZBWz/Sy+ab/ag==
Arc-message-signature: i=1; d=osuosl.org; s=arc; a=rsa-sha256; c=relaxed/relaxed; t=1793813454; h=Received-SPF:DKIM-Signature:DKIM-Signature:Date:Message-ID:To: Subject:MIME-Version:Content-Type:Content-Transfer-Encoding:X-Mailer: Sender:From:Feedback-ID:X-SES-Outgoing; bh=csS1PeOmou0ZWFHl5z3chxG95E4OwF4JXyVRb/uMnD8=; b=hFqCPj/ziJZuVStPgg8JhfRM0O73wAd0isKmHoue9AOjkjg6A5SScHNC9/4jZYvzZah8 QZbR0BQ6z9iuf/qUej+MYxQEslHiHKZJTNX215biFE1X7fiSeRWs/v4pzPslvYO4lReNM tcMUp6rijpG86xekxmSuMGWd3nTjvffs5cj7w+mr4DlV8lIA0FU1gJgBQNDE8wu9uQt2c uHcrgc2QzhSka+XTwGueN6qZCJ7OTgFZ9pWSMz13L942dl1EH7zo2tSeOayJpQZDhDmMQ iMvxiNBPWFJGXMXOrPQWA7BFxmc+QwfSdlOji9IP4Cv9pXeGNmr12Y3s/oHeQuVf4sg==
Arc-seal: i=2; d=osuosl.org; s=arc; a=rsa-sha256; cv=fail; t=1793815409; b=m64JAZA12sHa/EaRj7tTDKF9rgX45GPnJ/uUwqiJZIuU4HeFgpzuYnhpzBIuPnMk79PT w4KtZ+a00ON9B58tQQtZJPiCIxczUkusMy5M0+HLtrvdE2L2Gk6l88YqgHB9kgB2hW+78 4vIjwJ3VUx8r+8xwMrLJatS5lOqGm/zO4k+LgX3xO/CdQwr3j82EneUwrsv58Uxs6lyYn zXJi9dSp6gcg9U2j8+QSgfhuoQE4RiCcpZ3NpdV18hHdL7obRZd8XsaCIt8yvtVbozu6b 6RadiVhaK9N2D5GesVlzpwYDUJHp7BbZN4rfbfYHAoytL6fCTG80Vp9b2VdflYmSPSQ==
Arc-seal: i=1; d=osuosl.org; s=arc; a=rsa-sha256; cv=none; t=1793813454; b=nuUQHMDEjjmsp0rHWTaw+j8NNwXp7bvZ4vVR9Svm3Wnhp/pyOq+UgkDc2piX3jHzWRxA C/EVjgYhwViV8whrg+Y7ZW4YojrnRy1muGvufYYEgTscVhVPzUskhX3BN3Iw74vGJWOuW XhCPUbB2STNj9mkTtoflNxDtEy48pNRXSQHvWGcqpaAkJLstzQDO8urM7HaxU5jO+Lv4s krEeGeZjHkYtzJP9xVGyj4v1ac9O6C457JKp2FeTndbpNtplbHQQJ57VrJyq5HNpo5EYT KzuUP+gLD0AArzl2hM6auqWOCze9lv2Lpem91UQMqI/AqvpnQyfliiH4YyzprqbXXVg==
Archived-at: <https://lists.drupal.org/mailman3/hyperkitty/list/security-news AT drupal.org/message/TJS2RYPF7GWMOU5VEK43X7L34ILCFZES/>
Authentication-results: lists.piratenpartei.de; dkim=pass header.d=drupal.org header.s=default header.b=hDh7OMH6; dkim=fail ("body hash did not verify") header.d=drupal.org header.s=h2cwj55irf2bug4gly7tdskg3xbjhlg6 header.b=pQ9VmDI1; dkim=fail ("body hash did not verify") header.d=amazonses.com header.s=hsbnp7p3ensaochzwyq5wwmceodymuwv header.b="sbN3rl/R"; spf=pass (lists.piratenpartei.de: domain of security-news-bounces AT drupal.org designates 2605:bc80:3010::138 as permitted sender) smtp.mailfrom=security-news-bounces AT drupal.org; arc=reject ("cv is fail on i=2"); dmarc=pass (policy=none) header.from=drupal.org
Feedback-id: ::1.us-west-2.eaokZ1GT8utLqfMHQoyOsEFVrSIzzS6R+14LP6WIIUY=:AmazonSES
List-archive: <https://lists.drupal.org/mailman3/hyperkitty/list/security-news AT drupal.org/>
List-id: <security-news.drupal.org>

View online: https://www.drupal.org/sa-contrib-2026-295

Project: S3 File System CORS Upload [1]
Project machine name: s3fs_cors
Date: 2026-November-04
Security risk: *Critical* 16 ∕ 25
AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2]
Vulnerability: Access bypass

Affected versions: <1.3.0
CVE IDs: CVE-2026-122057
Description:
This module enables you to upload files from the browser directly to Amazon
S3 and register them as Drupal files, bypassing normal PHP file size and
timeout limits.

The module doesn't sufficiently check access to file uploads. Under certain
scenarios, users can delete files they should not have access to.

Solution:
Install the latest version:

* Upgrade to S3 File System CORS Upload 8.x-1.3 [3].

Reported By:
* Lucas Hedding (heddn) [4]

Fixed By:
* Lucas Hedding (heddn) [5]
* James Scott (jayelless) [6]

Coordinated By:
* Swan Kalata (akalata) [7] of the Drupal Security Team
* Greg Knaddison (greggles) [8] of the Drupal Security Team
* Juraj Nemec (poker10) [9] of the Drupal Security Team
* Jess (xjm) [10] of the Drupal Security Team

------------------------------------------------------------------------------
Contribution record [11]

[1] https://www.drupal.org/project/s3fs_cors
[2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined
[3] https://www.drupal.org/project/s3fs_cors/releases/8.x-1.3
[4] https://www.drupal.org/u/heddn
[5] https://www.drupal.org/u/heddn
[6] https://www.drupal.org/u/jayelless
[7] https://www.drupal.org/u/akalata
[8] https://www.drupal.org/u/greggles
[9] https://www.drupal.org/u/poker10
[10] https://www.drupal.org/u/xjm
[11] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal.org/node/3634403

_______________________________________________
Security-news mailing list -- security-news AT drupal.org
To unsubscribe send an email to security-news-leave AT drupal.org
Unsubscribe at

[IT-SecNots] [Security-news] S3 File System CORS Upload - Critical - Access bypass - SA-CONTRIB-2026-295, security-news, 04.11.2026

Archiv bereitgestellt durch MHonArc 2.6.19+.