Read the docs
TI-2025-19958 Aliases CVE-2025-27088GHSA-pp9m-qf39-hxjc

Reflected Cross-site Scripting (XSS) in template implementation in oxyno-zeta/s3-proxy

Priority HIGH 70CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

oxyno-zeta/s3-proxy is an aws s3 proxy written in go. In affected versions a Reflected Cross-site Scripting (XSS) vulnerability enables attackers to create malicious URLs that, when visited, inject scripts into the web application. This can lead to session hijacking or phishing attacks on a trusted domain, posing a moderate risk to all users. It's possible to inject html elements, including scripts through the folder-list template. The affected template allows users to interact with the URL path provided by the `Request.URL.Path` variable, which is then rendered directly into the HTML without proper sanitization or escaping. This can be abused by attackers who craft a malicious URL containing injected HTML or JavaScript. When users visit such a URL, the malicious script will be executed in the user's context. This issue has been addressed in version 4.18.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00497 42nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed s3-proxy (oxyno-zeta): 4.18.0github.com/oxyno-zeta/s3-proxy/cmd/s3-proxy (Go): 0.0.0-20250220214310-c611c741ed48

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
oxyno-zetas3-proxybefore 4.18.04.18.0Patch availableCNA
—github.com/oxyno-zeta/s3-proxy/cmd/s3-proxy (Go)before 0.0.0-20250220214310-c611c741ed480.0.0-20250220214310-c611c741ed48Patch availableGHSA-pp9m-qf39-hxjc
  • s3-proxy Vendoroxyno-zeta Affected before 4.18.0 Fixed in 4.18.0 Patch available CNA
  • github.com/oxyno-zeta/s3-proxy/cmd/s3-proxy (Go) Vendor— Affected before 0.0.0-20250220214310-c611c741ed48 Fixed in 0.0.0-20250220214310-c611c741ed48 Patch available GHSA-pp9m-qf39-hxjc

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:oxyno-zeta:s3-proxy:*:*:*:*:*:helm:*:*before 2.23.1Vulnerableoxyno-zeta
cpe:2.3:a:oxyno-zeta:s3-proxy:*:*:*:*:*:docker:*:*before 4.18.1Vulnerableoxyno-zeta
cpe:2.3:a:oxyno-zeta:s3-proxy:*:*:*:*:*:go:*:*before 4.18.1Vulnerableoxyno-zeta
  • cpe:2.3:a:oxyno-zeta:s3-proxy:*:*:*:*:*:helm:*:* Versions before 2.23.1 Vulnerable ·oxyno-zeta
  • cpe:2.3:a:oxyno-zeta:s3-proxy:*:*:*:*:*:docker:*:* Versions before 4.18.1 Vulnerable ·oxyno-zeta
  • cpe:2.3:a:oxyno-zeta:s3-proxy:*:*:*:*:*:go:*:* Versions before 4.18.1 Vulnerable ·oxyno-zeta

Remediation

  • Fix · CNA s3-proxy (oxyno-zeta) Fixed in 4.18.0
  • Fix · GHSA-pp9m-qf39-hxjc github.com/oxyno-zeta/s3-proxy/cmd/s3-proxy (Go) Fixed in 0.0.0-20250220214310-c611c741ed48 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-27088
  2. 2026-10-03 Alias added: GHSA-pp9m-qf39-hxjc

References

Exploit 1

Patch 1

Advisory 1

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences