Read the docs
TI-2023-28302 Aliases CVE-2023-51651GHSA-557v-xcg6-rm5m

Potential URI resolution path traversal in the AWS SDK for PHP

Priority LOW 27CWE-22Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

AWS SDK for PHP is the Amazon Web Services software development kit for PHP. Within the scope of requests to S3 object keys and/or prefixes containing a Unix double-dot, a URI path traversal is possible. The issue exists in the `buildEndpoint` method in the RestSerializer component of the AWS SDK for PHP v3 prior to 3.288.1. The `buildEndpoint` method relies on the Guzzle Psr7 UriResolver utility, which strips dot segments from the request path in accordance with RFC 3986. Under certain conditions, this could lead to an arbitrary object being accessed. This issue has been patched in version 3.288.1.

Why it matters now

EPSS 0.00376 31st percentileScored 2026-11-07
Fix Fixed aws-sdk-php (aws): 3.288.1aws/aws-sdk-php (Packagist): 3.288.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
AWSaws-sdk-php3.0.0 to before 3.288.13.288.1Patch availableCNA
—aws/aws-sdk-php (Packagist)before 3.288.13.288.1Patch availableGHSA-557v-xcg6-rm5m
  • aws-sdk-php VendorAWS Affected 3.0.0 to before 3.288.1 Fixed in 3.288.1 Patch available CNA
  • aws/aws-sdk-php (Packagist) Vendor— Affected before 3.288.1 Fixed in 3.288.1 Patch available GHSA-557v-xcg6-rm5m

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:amazon:aws_software_development_kit:*:*:*:*:*:php:*:*before 3.288.1VulnerableAWS
  • cpe:2.3:a:amazon:aws_software_development_kit:*:*:*:*:*:php:*:* Versions before 3.288.1 Vulnerable ·AWS

Remediation

  • Fix · CNA aws-sdk-php (aws) Fixed in 3.288.1
  • Fix · GHSA-557v-xcg6-rm5m aws/aws-sdk-php (Packagist) Fixed in 3.288.1 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-51651
  2. 2026-10-03 Alias added: GHSA-557v-xcg6-rm5m

References

Patch 1

Advisory 2

Other 3

  • TI-2022-04321 AWS SDK XML Parser XpathUtils.java XpathUtils server-side request forgery CVSS 3.1CRITICAL 9.8
  • TI-2018-14164 Amazon AWS SDK <=2.8.5 for Android uses Android SharedPreferences to store plain text AWS… CVSS 3.0HIGH 7.2
  • TI-2026-15952 Out-of-bounds read in the Base64 decoder in Amazon aws-sdk-cpp on signed-char platforms CVSS 4.0MEDIUM 6.0
  • TI-2026-15951 Out-of-bounds write in the Base64 decoder in Amazon aws-sdk-cpp CVSS 4.0MEDIUM 6.0
  • TI-2022-02384 Exposure of unencrypted plaintext hash in github.com/aws/aws-sdk-go CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences