Date: 
Wednesday, Oct 28th, 2026
Advisory ID: 
BACKDROP-SA-CONTRIB-2026-020
Security risk: 
Moderately Critical
Vulnerability: 
Access bypass
CVE ID: 
CVE-2026-118574
Versions affected: 
  • S3FA 1.x-3.x versions prior to 1.x-3.0.16
  • S3FA 1.x-4.x versions prior to 1.x-4.0.2
Description: 

S3 File System (s3fs) provides an additional file system to your Backdrop site that stores files in Amazon's Simple Storage Service (S3) storage.

The module doesn't sufficiently isolate upload context between separate object (file) operations in the same request, resulting in the potential for objects to be uploaded with incorrect access control list (ACL) entries or corruption through incorrect operation metadata.

This can be triggered by normal file operations, such as uploads, image style derivatives and bee s3fs-copy-local.

Some vectors are mitigated by:

  • Not enabling "Use S3 for private:// files", or (1.x-4.x only) only enabling it with "Don't set ACLs on uploaded objects".
  • The site does not implement hook_s3fs_upload_params_alter().

If both points above have always been true all currently known vectors are mitigated.

Solution: 

Install the latest version:

  • If you use the 1.x-3.x branch, upgrade to S3FS 1.x-3.0.16
  • If you use the 1.x-4.x branch, upgrade to S3FS 1.x-4.0.2

Download available on the S3FS releases page.

Reported By: 
Fixed By: 
Coordinated By: 

Security email list

Backdrop maintains a security mailing list. Whenever a security release comes out, an email will be sent to everyone subscribed to that list, announcing the new release. Please follow the steps below to join the Security email list.

  1. Log in to backdropcms.org
  2. Edit your profile
  3. Switch to the "Subscriptions" tab
  4. Check the box labeled "Security updates"
  5. Save the form