PT-2026-25817 · Craft Cms+1 · Craft Cms+1

Neosprings · Publicado 2026-03-16 · Atualizado 2026-03-18 · CVE-2026-32265

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Média

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Amazon S3 for Craft CMS versions 2.0.2 through 2.2.4

Description The Amazon S3 for Craft CMS plugin integrates Amazon S3 with Craft CMS. In versions 2.0.2 through 2.2.4, unauthenticated users can view a list of buckets the plugin has access to. The BucketsController->actionLoadBucketData() endpoint allows unauthenticated users with a valid CSRF token to view a list of buckets that the plugin is permitted to access.

Recommendations Update the plugin to version 2.2.5.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2026-32265

GHSA-HWJ7-4VGC-J3V9

Produtos afetados

Amazon S3 For Craft Cms

Craft Cms

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32265.json · Exploit
• https://github.com/craftcms/aws-s3/security/advisories/GHSA-hwj7-4vgc-j3v9 · Nota
• https://github.com/craftcms/aws-s3/commit/ef8904d8b6856e4a52893a9e1e52988ae110aa3f · Nota
• https://github.com/craftcms/aws-s3 · Nota
• https://osv.dev/vulnerability/CVE-2026-32265 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2034136410467221996 · Publicação no Twitter
• https://twitter.com/CVEarity/status/2034162123572711486 · Publicação no Twitter
• https://reddit.com/r/VulnMatter/comments/1rvkawc/resumen_diario_de_vulnerabilidades_16032026 · Publicação no Reddit
• https://nvd.nist.gov/vuln/detail/CVE-2026-32265 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-hwj7-4vgc-j3v9 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/2034270717689188663 · Publicação no Twitter