medium6.9
CVE-2026-32265
Amazon S3 for Craft CMS has an Information Disclosure vulnerability
Impact
Unauthenticated users can view a list of buckets the plugin has access to. The `BucketsController->actionLoadBucketData()` endpoint allows unauthenticated users with a valid CSRF token to view a list of buckets that the plugin is allowed to see. Users should update to version 2.2.5 of the plugin to mitigate the issue.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | craftcms/aws-s3 | >= 2.0.2, <= 2.2.4 | 2.2.5 |
Affected products
| Product | Affected versions |
|---|---|
| Versions 2.0.2 | through 2.2.4 |
Versions were read from the advisory text. No structured product data has been published for this record yet.