Vulnerability DRUPAL-CONTRIB-2026-295
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
4 hours ago
November 04, 2026 at 05:30 PM UTC
No summary available
<1.3.0
<1.3.0
Details
This module enables you to upload files from the browser directly to Amazon S3 and register them as Drupal files, bypassing normal PHP file size and timeout limits.
The module doesn't sufficiently check access to file uploads. Under certain scenarios, users can delete files they should not have access to.
References
Impacted packages
Timeline
Published
4 hours ago
November 04, 2026 at 05:30 PM UTC
Last Modified
1 hour ago
November 04, 2026 at 08:30 PM UTC