Intel

AIKIDO-2025-10236

@webiny/api-file-manager-s3 is vulnerable to Improper Input Validation

Improper Input Validation Pre-CVE
Found by Aikido Intel before public disclosure or CVE publication.

50

Medium Risk

This Affects:

JS@webiny/api-file-manager-s3
5.0.0 - 5.42.0
Fixed in 5.42.1

TL;DR

Affected versions of this package are vulnerable to improper input validation, exposing the system to potential threats via uploaded files. To mitigate this, threat detection is introduced for all files uploaded to the File Manager. Uploaded files remain disabled until the threat scan completes; if malicious content is detected, the file is deleted, otherwise it is enabled for user access.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range.

Background info

@webiny/api-file-manager-s3 is vulnerable to Improper Input Validation in versions 5.0.0 - 5.42.0.

How to fix this

Upgrade the @webiny/api-file-manager-s3 library to the patch version.