Drupal Advanced Filesystem EUVD-2026-113558

Exploitation requires a victim who is an authenticated Drupal user with sufficient privileges to perform the targeted Advanced Filesystem action, and who, while logged in, is tricked into loading attacker-controlled content (a web page, ad, or email) that issues the forged request. The affected scope is Drupal sites running the Advanced Filesystem contrib module at any version from 0.0.0 up to but not including 1.0.28. The principal limiting factor is that no privileged standalone attacker access is needed, but the attack cannot succeed without an active, authenticated victim session and the victim interacting with attacker-controlled content - contrary to the official vector's UI:N, this user-interaction dependency materially reduces realistic exploitability.

This is a moderate-severity, low-priority issue in practice. The official CVSS 3.1 base score is 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), reflecting network reach and no required privileges, but the only impact is partial integrity (C:N/I:L/A:N) - no confidentiality or availability loss. Notably, the vector's UI:N is inconsistent with the vulnerability class: CSRF (CWE-352) by definition requires an authenticated victim to be lured into triggering a forged request, so real-world exploitation depends on user interaction that the official vector does not reflect - verify with vendor. The exploitation signals are weak and consistent with each other: EPSS is 0.10% (1st percentile), SSVC reports Exploitation: none, and there is no CISA KEV listing and no public exploit identified. The one elevating signal is SSVC Automatable: yes, meaning the forged request could be mass-delivered, but Technical Impact is only partial. The vuln.today decision label is this_month, i.e. routine patch scheduling rather than emergency. Overall this is a genuine but low-urgency defect: a high-reach-but-low-impact CSRF that should be remediated on a normal cycle, not treated as an active-exploitation emergency.

An attacker crafts a malicious web page or email containing a forged request targeting a privileged Drupal action exposed by the Advanced Filesystem module. When an authenticated Drupal user with the relevant permissions visits the attacker's page while logged in, their browser silently submits the forged state-changing request, causing an unintended modification under the victim's session. No public exploit code has been identified at time of analysis.