CVE-2025-27088

oxyno-zeta/s3-proxy is an aws s3 proxy written in go. In affected versions a Reflected Cross-site Scripting (XSS) vulnerability enables attackers to create malicious URLs that, when visited, inject scripts into the web application. This can lead to session hijacking or phishing attacks on a trusted domain, posing a moderate risk to all users. It's possible to inject html elements, including scripts through the folder-list template. The affected template allows users to interact with the URL path provided by the `Request.URL.Path` variable, which is then rendered directly into the HTML without proper sanitization or escaping. This can be abused by attackers who craft a malicious URL containing injected HTML or JavaScript. When users visit such a URL, the malicious script will be executed in the user's context. This issue has been addressed in version 4.18.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

• CWE-79
• CWE-79

• https://github.com/oxyno-zeta/s3-proxy/blob/master/templates/folder-list.tpl#L19C21-L19C38Product
• https://github.com/oxyno-zeta/s3-proxy/commit/c611c741ed4872ea3f46232be23bb830f96f9564Patch
• https://github.com/oxyno-zeta/s3-proxy/security/advisories/GHSA-pp9m-qf39-hxjcExploit, Vendor Advisory
• https://github.com/oxyno-zeta/s3-proxy/security/advisories/GHSA-pp9m-qf39-hxjcExploit, Vendor Advisory

Published

Feb 20, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-27082Arbitrary File Write vulnerabilities exist in the web-based …7.2
• CVE-2025-27083Authenticated command injection vulnerabilities exist in the…7.2
• CVE-2025-27084A vulnerability in the Captive Portal of an AOS-10 GW and AO…6.1
• CVE-2025-27085Multiple vulnerabilities exist in the web-based management i…4.9
• CVE-2025-27086A vulnerability in the HPE Performance Cluster Manager (HPCM…8.1
• CVE-2025-27087A vulnerability in the kernel of the Cray Operating System (…5.5
• CVE-2025-27089Directus is a real-time API and App dashboard for managing S…4.3
• CVE-2025-2709A vulnerability has been found in Yonyou UFIDA ERP-NC 5.0 an…6.1
• CVE-2025-27090Sliver is an open source cross-platform adversary emulation/…5.3
• CVE-2025-27091OpenH264 is a free license codec library which supports H.26…7.5
• CVE-2025-27092GHOSTS is an open source user simulation framework for cyber…7.5
• CVE-2025-27093Sliver is a command and control framework that uses a custom…6.3