aws/aws-sdk-php vulnerabilities

Latest aws/aws-sdk-php CVEs

Newest publication first

1. GHSA-27qh-8cxx-2cr5 AWS SDK for PHP has CloudFront Policy Document Injection via Special Characters

   Published 2026-03-27

   High·CVSS 7.7

   Summary This notification is related to the CloudFront signing utilities in the AWS SDK for PHP, which are used to generate Amazon CloudFront signed URLs and signed cookies. A defense-in-depth enhancement has been implemented to improve handling of special characters, such as dou...

2. CVE-2023-51651 Potential URI resolution path traversal in the AWS SDK for PHP

   Published 2026-01-22

   Low·CVSS 3.3 EPSS 0.38% PoC

   Directory Traversal vulnerability in Beam beta9 v.0.1.521 allows a remote attacker to obtain sensitive information via the joinCleanPath function.

3. CVE-2025-14761 AWS SDK for PHP's S3 Encryption Client has a Key Commitment Issue

   Published 2025-12-17

   Medium·CVSS 6.0 EPSS 0.21% PoC

   Missing cryptographic key commitment in the AWS SDK for PHP may allow a user with write access to the S3 bucket to introduce a new EDK that decrypts to different plaintext when the encrypted data key is stored in an "instruction file" instead of S3's metadata record. To mitigate...

4. CVE-2015-5723 Doctrine Security Misconfiguration Vulnerability

   Published 2016-06-07

   High·CVSS 7.8 EPSS 0.38% PoC

   Doctrine Annotations before 1.2.7, Cache before 1.3.2 and 1.4.x before 1.4.2, Common before 2.4.3 and 2.5.x before 2.5.1, ORM before 2.4.8 or 2.5.x before 2.5.1, MongoDB ODM before 1.0.2, and MongoDB ODM Bundle before 3.0.1 use world-writable permissions for cache directories, wh...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.