CVE-2025-24961CWE-22

Insecure path traversal in filesystem and filesystem-nio2 storage backends in org.gaul S3Proxy

Medium · published February 3, 2025

CVSS v4.0
6.0
EPSS
1%
Percentile
45.1
In the wild
Unconfirmed
What it is

org.gaul S3Proxy implements the S3 API and proxies requests. Users of the filesystem and filesystem-nio2 storage backends could unintentionally expose local files to users. This issue has been addressed in version 2.6.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.

The record
Technical detail
CVSS v4.0
6.0 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00547 · 45.1th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2025-02-03T20:29Z
EPSS history
Timeline
  • 03 FEB 20:29Z
    Insecure path traversal in filesystem and filesystem-nio2 storage backends in org.gaul S3Proxy
    cvelistv5