Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-42882— oxyno-zeta/s3-proxy: Security Issues in Resource Path Matching

Quick assessment

Affected
oxyno-zeta s3-proxy
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

s3-proxy是Havrileck Alexandre个人开发者的一个多功能的S3存储桶代理工具。 s3-proxy 5.0.0之前版本存在路径遍历漏洞，该漏洞源于身份验证中间件与存储桶处理器之间URL路径解释不一致，导致身份验证绕过，允许未经身份验证的攻击者对受保护的S3命名空间执行未经授权的写入、读取或删除操作。

CVSS 9.4 · Critical EPSS 0.72% · P53

Affected Version Matrix 1

VendorProduct Version RangeStatus
oxyno-zeta s3-proxy < 5.0.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-42882

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
oxyno-zeta/s3-proxy: Security Issues in Resource Path Matching
Source: CVE Program / CVE List V5
Vulnerability Description
oxyno-zeta/s3-proxy is an aws s3 proxy written in go. Prior to 5.0.0, s3-proxy contains an authentication bypass caused by inconsistent URL path interpretation between the authentication middleware and the bucket handler. The authentication middleware evaluates resource path patterns against the percent-encoded request URI (r.URL.RequestURI()), while the bucket handler constructs S3 object keys from the decoded path (r.URL.Path). This mismatch, combined with the glob library being invoked without a path separator (causing * to match across / boundaries), allows unauthenticated attackers to write to, read from, or delete objects in protected S3 namespaces. Exploitation is possible via three techniques: (1) using * patterns that match across path separators to reach protected routes via path traversal (e.g., /open/foo/drafts/../restricted/), (2) using percent-encoded slashes (%2F) to collapse multiple path segments into a single token at the auth layer while the decoded form resolves to a protected namespace at the storage layer, and (3) using dot-dot segments (../) under ** prefix patterns, where the raw path matches an open route while Go's URL parser resolves the traversal to a protected path before the bucket handler runs. An unauthenticated attacker with network access can perform unauthorized PUT, GET, or DELETE operations on objects in authentication-protected S3 namespaces. This vulnerability is fixed in 5.0.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Vulnerability Title
s3-proxy 路径遍历漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
s3-proxy是Havrileck Alexandre个人开发者的一个多功能的S3存储桶代理工具。 s3-proxy 5.0.0之前版本存在路径遍历漏洞，该漏洞源于身份验证中间件与存储桶处理器之间URL路径解释不一致，导致身份验证绕过，允许未经身份验证的攻击者对受保护的S3命名空间执行未经授权的写入、读取或删除操作。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
oxyno-zeta s3-proxy < 5.0.0 -

II. Public POCs for CVE-2026-42882

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-42882

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-42882 (2)

Vendor Advisories for CVE-2026-42882 (1)

IV. Related Vulnerabilities

Same product: s3-proxy
Same vendor: oxyno-zeta
Same weakness: CWE-22