PT-2026-25817 · Packagist · Craftcms/Aws-S3

Published 2026-03-16 · Updated 2026-03-16 · CVE-2026-32265

OSV

CVSS v4.0

6.9

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Unauthenticated users can view a list of buckets the plugin has access to.

The

BucketsController->actionLoadBucketData()

endpoint allows unauthenticated users with a valid CSRF token to view a list of buckets that the plugin is allowed to see.

Users should update to version 2.2.5 of the plugin to mitigate the issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-32265

GHSA-HWJ7-4VGC-J3V9

Affected Products

Craftcms/Aws-S3

References · 4

• https://osv.dev/vulnerability/GHSA-hwj7-4vgc-j3v9 · Vendor Advisory
• https://github.com/craftcms/aws-s3 · Note
• https://github.com/craftcms/aws-s3/security/advisories/GHSA-hwj7-4vgc-j3v9 · Note
• https://github.com/craftcms/aws-s3/commit/ef8904d8b6856e4a52893a9e1e52988ae110aa3f · Note