Cross-Site Request Forgery in Drupal Advanced Filesystem
CVE-2026-107262

Currently unrated

Key Information:

Vendor: Drupal
Status: Advanced Filesystem
Vendor: CVE Published:; 30 October 2026

What is CVE-2026-107262?

A Cross-Site Request Forgery (CSRF) vulnerability exists within the Drupal Advanced Filesystem, which could allow an attacker to perform unauthorized actions on behalf of an authenticated user. This vulnerability affects all versions of the Advanced Filesystem from 0.0.0 to 1.0.28, presenting a significant risk for web applications that rely on this module. Proper mitigation strategies should be implemented to ensure the security of affected systems.

Affected Version(s)

Advanced Filesystem 0.0.0 < 1.0.28

References

https://www.drupal.org/sa-contrib-2026-217

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Oct 30, 2026
Vulnerability Reserved
Oct 7, 2026

Credit

Marcus Johansson (marcus_johansson)

Cristiano Demari (cristianodemari)

Greg Knaddison (greggles)

Juraj Nemec (poker10)

CVE-2026-107262 Data

JSON