CVE-2026-32265: Amazon S3 for Craft CMS has an Information Disclosure vulnerability

March 16, 2026 (updated March 19, 2026)

Unauthenticated users can view a list of buckets the plugin has access to.

The BucketsController->actionLoadBucketData() endpoint allows unauthenticated users with a valid CSRF token to view a list of buckets that the plugin is allowed to see.

Users should update to version 2.2.5 of the plugin to mitigate the issue.

References

github.com/advisories/GHSA-hwj7-4vgc-j3v9
github.com/craftcms/aws-s3
github.com/craftcms/aws-s3/commit/ef8904d8b6856e4a52893a9e1e52988ae110aa3f
github.com/craftcms/aws-s3/security/advisories/GHSA-hwj7-4vgc-j3v9
nvd.nist.gov/vuln/detail/CVE-2026-32265

Code Behaviors & Features

Detect and mitigate CVE-2026-32265 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →