s3-proxy vulnerabilities

2 known vulnerabilities in s3-proxy from Oxyno-zeta. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.4 Critical severity

  s3-proxy: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-42882May 11, 2026Oxyno-zeta

  oxyno-zeta/s3-proxy is an aws s3 proxy written in go. Prior to 5.0.0, s3-proxy contains an authentication bypass caused by inconsistent URL path interpretation between the authentication middleware and the bucket handler. The authentication middleware evaluate

• 8.2 High severity

  s3-proxy: Improper Neutralization of Input During Web Page Generation

  CVE-2025-27088Feb 20, 2025Oxyno-zeta

  oxyno-zeta/s3-proxy is an aws s3 proxy written in go. In affected versions a Reflected Cross-site Scripting (XSS) vulnerability enables attackers to create malicious URLs that, when visited, inject scripts into the web application. This can lead to session hij