PT-2026-25817 · Craft Cms+1 · Craft Cms+1

Neosprings · Published 2026-03-16 · Updated 2026-03-18 · CVE-2026-32265

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Amazon S3 for Craft CMS versions 2.0.2 through 2.2.4

Description The Amazon S3 for Craft CMS plugin integrates Amazon S3 with Craft CMS. In versions 2.0.2 through 2.2.4, unauthenticated users can view a list of buckets the plugin has access to. The BucketsController->actionLoadBucketData() endpoint allows unauthenticated users with a valid CSRF token to view a list of buckets that the plugin is permitted to access.

Recommendations Update the plugin to version 2.2.5.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-32265

GHSA-HWJ7-4VGC-J3V9

Affected Products

Amazon S3 For Craft Cms

Craft Cms

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32265.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-32265 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32265 · Security Note
• https://osv.dev/vulnerability/GHSA-hwj7-4vgc-j3v9 · Vendor Advisory
• https://github.com/craftcms/aws-s3/security/advisories/GHSA-hwj7-4vgc-j3v9 · Note
• https://github.com/craftcms/aws-s3/commit/ef8904d8b6856e4a52893a9e1e52988ae110aa3f · Note
• https://github.com/craftcms/aws-s3 · Note
• https://twitter.com/CVEnew/status/2034136410467221996 · Twitter Post
• https://twitter.com/CVEarity/status/2034162123572711486 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1rvkawc/resumen_diario_de_vulnerabilidades_16032026 · Reddit Post
• https://twitter.com/VulmonFeeds/status/2034270717689188663 · Twitter Post