AIKIDO-2026-292173
aws/aws-sdk-php is vulnerable to Path Traversal
55
Medium Risk
This Affects:
aws/aws-sdk-phpTL;DR
The legacy Aws\S3\Transfer download guard in resolvesOutsideTargetDirectory() tokenized sink and object-key paths only on forward slashes. On Windows, PHP treats backslashes as directory separators in fopen, mkdir, and dirname, so an S3 object key such as inbox/..\shell.php under a synced prefix can resolve outside the intended destination directory even though the guard accepts it. A remote peer that can place crafted keys in the synced bucket can therefore write files outside the target folder during Transfer downloads on Windows hosts. Version 3.388.12 aligns this guard with S3Transfer\DirectoryDownloader by splitting on both / and \.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range, run on Windows, and use Aws\S3\Transfer to download or sync objects from S3 buckets whose keys an attacker can influence.
Background info
aws/aws-sdk-php is vulnerable to Path Traversal in versions 3.27.0 - 3.388.11.
How to fix this
Upgrade aws/aws-sdk-php library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant