drupal/s3fs - SA-CONTRIB-2023-014
S3 File System (s3fs) provides an additional file system to your Drupal site, which stores files in Amazon's Simple Storage Service (S3) or any other S3-compatible storage service.
This module may fail to validate that a file being requested to be moved to storage was uploaded during the same web request, possibly allowing an attacker to move files that should normally be inaccessible to them.
This vulnerability is mitigated by the fact that another vulnerability must already exist outside of s3fs.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | drupal/s3fs | < 3.2.0 | 3.2.0 |
| Drupal module | drupal/s3fs | < 3.2.0 | 3.2.0 |
References
- Weakness (CWE)
-- Platform
- Composer, Drupal
- Package
drupal/s3fs- Disclosed
- 03.05.2023
- Updated
- 11.10.2026 12:18
Sources and licenses
OSV / GitHub Advisory Database - DRUPAL-CONTRIB-2023-014 - CC BY-SA 2.0; code GPL-2.0-or-later
Vulnerability history: drupal/s3fs
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
This is the only known vulnerability of this package.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.