The vulnerability is a CSRF flaw allowing attackers to perform actions on behalf of authenticated users without their consent, potentially leading to unauthorized content modification or privilege escalation. It is categorized as CWE‑352 and can compromise confidentiality, integrity and availability of the website data.

The flaw affects the Drupal Advanced Filesystem module for versions 0.0.0 through 1.0.28. Users of the Advanced Filesystem module on any Drupal site running those versions are exposed.

The defect is an HTTP request‑based flaw that does not require privileged access and can be triggered by a malicious web page. EPSS data is not available, and the issue is not listed in the CISA KEV catalog. The absence of a CVSS score in the input limits a precise numeric rating, but the label “moderately critical” and the nature of CSRF imply a high likelihood of exploitation against sites with exposed forms or actions. The risk is elevated for sites that allow authenticated users to perform state‑changing operations in the module.