GHSA-hwj7-4vgc-j3v9

Source

https://github.com/advisories/GHSA-hwj7-4vgc-j3v9

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-hwj7-4vgc-j3v9/GHSA-hwj7-4vgc-j3v9.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-hwj7-4vgc-j3v9

Aliases

CVE-2026-32265

Published

2026-03-16T18:13:33Z

Modified

2026-03-19T21:17:22Z

Severity

6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Amazon S3 for Craft CMS has an Information Disclosure vulnerability

Details

Unauthenticated users can view a list of buckets the plugin has access to.

The BucketsController->actionLoadBucketData() endpoint allows unauthenticated users with a valid CSRF token to view a list of buckets that the plugin is allowed to see.

Users should update to version 2.2.5 of the plugin to mitigate the issue.

Database specific

{
    "cwe_ids":  [
        "CWE-200"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-03-16T18:13:33Z",
    "nvd_published_at":  "2026-03-18T04:17:27Z",
    "severity":  "MODERATE"
}

References

Affected packages

Packagist / craftcms/aws-s3

Package

Name: craftcms/aws-s3
Purl: pkg:composer/craftcms/aws-s3

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.0.2

Fixed

2.2.5

Affected versions

2.*

2.0.2

2.0.3

2.1.0

2.2.0

2.2.1

2.2.2

2.2.3

2.2.4

Database specific

last_known_affected_version_range

"<= 2.2.4"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-hwj7-4vgc-j3v9/GHSA-hwj7-4vgc-j3v9.json"