CVE-2026-118574

Name of the Vulnerable Software and Affected Versions S3 File System versions 0.0.0 through 3.12.0

Description The module fails to sufficiently isolate upload context between separate object operations within the same request. This can lead to objects being uploaded with incorrect access control list (ACL) entries or data corruption due to incorrect operation metadata. Exploitation requires the ability to trigger multiple file operations on S3FS.

Recommendations Update S3 File System to a version later than 3.12.0. Disable private:// takeover by setting $settings['s3fs.use s3 for private'] = FALSE; or ensure it is only enabled with $settings['s3fs.upload as private'] = TRUE;. Avoid utilizing the functions hook s3fs stream open params alter(), hook s3fs upload params alter(), hook s3fs copy params alter(), and hook s3fs command params alter().