The S3 File System CORS Upload module for Drupal allows users to upload files directly from the browser to Amazon S3 or compatible services via a file widget. A vulnerability exists where the module does not sufficiently restrict upload permissions, enabling users with upload access to overwrite existing files in the bucket, including those they normally could not replace. Exploitation requires access to a form using this upload widget. The issue is fixed in version 1.4.0.