GitHub Advisoryadvisory · Packagist

GHSA-hwj7-4vgc-j3v9 Amazon S3 for Craft CMS has an Information Disclosure vulnerability

MEDIUM Published 2026-03-16 Modified 2026-03-19 Official page ↗
Aliases
CVE-2026-32265
Ecosystem
Packagist
Packages
craftcms/aws-s3
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-200
Reviewed
2026-03-16

Affected packages

• Packagist craftcms/aws-s3: >= 2.0.2, < 2.2.5 → fixed in 2.2.5

Description

Unauthenticated users can view a list of buckets the plugin has access to. The `BucketsController->actionLoadBucketData()` endpoint allows unauthenticated users with a valid CSRF token to view a list of buckets that the plugin is allowed to see. Users should update to version 2.2.5 of the plugin to mitigate the issue.

Related

Alias · CVE (1)

  • CVE-2026-32265 The Amazon S3 for Craft CMS plugin provides an Amazon S3 integration for Craft CMS. vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References