CVE-2025-69820
BaseFortify
Publication date: 2026-01-22
Last updated on: 2026-02-02
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| beam | beta9 | 0.1.521 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a directory traversal issue in the AWS SDK for PHP prior to version 3.288.1. It occurs in the buildEndpoint method of the RestSerializer component, where the URI path normalization using the Guzzle Psr7 UriResolver can be bypassed if S3 object keys or prefixes contain double-dot (..) segments. This allows an attacker to access files or objects outside the intended directory or prefix by manipulating the path, effectively obtaining unauthorized sensitive information. [2]
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized access to arbitrary S3 objects outside the intended restricted directory or prefix, compromising confidentiality and integrity of data. Although the attack requires local access with high privileges and has low complexity, it does not affect availability. This means sensitive information could be exposed or altered by an attacker exploiting this flaw. [2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection can involve checking the version of the AWS SDK for PHP in use to see if it is prior to 3.288.1, which is vulnerable. Additionally, monitoring for unusual or unauthorized access attempts involving S3 object keys or prefixes containing '..' segments may indicate exploitation attempts. Specific commands to check the SDK version could include: `composer show aws/aws-sdk-php` or inspecting the version in your project's dependency files. Network detection might require custom logging or monitoring for suspicious URI paths with traversal patterns. However, no explicit detection commands are provided in the resources. [2]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade the AWS SDK for PHP to version 3.288.1 or later, where the vulnerability has been fixed. This upgrade addresses the path traversal issue in the `buildEndpoint` method of the `RestSerializer` component by properly normalizing request paths and preventing bypass of dot-segment stripping. [2]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows unauthorized access to arbitrary S3 objects outside the intended restricted directory, potentially leading to exposure of sensitive information. Such unauthorized data access can result in non-compliance with data protection regulations like GDPR and HIPAA, which require strict controls over access to personal and sensitive data. Therefore, this vulnerability poses a risk to compliance with these standards by compromising confidentiality and integrity of data. [2]