PT-2025-5605 · Org.Gaul · 3Proxy

Xbow-Security · Published 2025-02-03 · Updated 2025-02-03 · CVE-2025-24961

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: org.gaul S3Proxy versions prior to 2.6.0

Description: The issue affects users of the filesystem and filesystem-nio2 storage backends, potentially exposing local files to authenticated clients. This could lead to unauthorized access to sensitive information. There are no known workarounds for this issue.

Recommendations: For versions prior to 2.6.0, upgrade to version 2.6.0 to resolve the issue. As a temporary workaround, consider restricting access to the filesystem and filesystem-nio2 storage backends until the upgrade is applied.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-24961

GHSA-2CCP-VQMV-4R4X

Affected Products

3Proxy

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/24xxx/CVE-2025-24961.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-24961 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-24961 · Security Note
• https://osv.dev/vulnerability/GHSA-2ccp-vqmv-4r4x · Vendor Advisory
• https://github.com/gaul/s3proxy/security/advisories/GHSA-2ccp-vqmv-4r4x · Note
• https://github.com/gaul/s3proxy · Note
• https://github.com/gaul/s3proxy/commit/86b6ee4749aa163a78e7898efc063617ed171980 · Note
• https://github.com/apache/jclouds/commit/b0819e0ef5e08c792a4d1724b938714ce9503aa3 · Note
• https://t.me/cvedetector/17132 · Telegram Post
• https://twitter.com/CVEnew/status/1886523329278042131 · Twitter Post