CVE-2023-51651
Potential URI resolution path traversal in the AWS SDK for PHP
AWS SDK for PHP is the Amazon Web Services software development kit for PHP. Within the scope of requests to S3 object keys and/or prefixes containing a Unix double-dot, a URI path traversal is possible. The issue exists in the buildEndpoint method in the RestSerializer component of the AWS SDK for PHP v3 prior to 3.288.1. The buildEndpoint method relies on the Guzzle Psr7 UriResolver utility, which strips dot segments from the request path in accordance with RFC 3986. Under certain conditions, this could lead to an arbitrary object being accessed. This issue has been patched in version 3.288.1.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Potential URI resolution path traversal in the AWS SDK for PHP
AWS SDK for PHP is the Amazon Web Services software development kit for PHP. Within the scope of requests to S3 object keys and/or prefixes containing a Unix double-dot, a URI path traversal is possible. The issue exists in the buildEndpoint method in the RestSerializer component of the AWS SDK for PHP v3 prior to 3.288.1. The buildEndpoint method relies on the Guzzle Psr7 UriResolver utility, which strips dot segments from the request path in accordance with RFC 3986. Under certain conditions, this could lead to an arbitrary object being accessed. This issue has been patched in version 3.288.1.
- Record
CVE-2023-51651- CVSS 3.1
- 6.0 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
EUVDEUVD-2023-3109
AWS SDK for PHP is the Amazon Web Services software development kit for PHP. Within the scope of requests to S3 object keys and/or prefixes containing a Unix double-dot, a URI path traversal is possible. The issue exists in the buildEndpoint method in the RestSerializer component of the AWS SDK for PHP v3 prior to 3.288.1. The buildEndpoint method relies on the Guzzle Psr7 UriResolver utility, which strips dot segments from the request path in accordance with RFC 3986. Under certain conditions, this could lead to an arbitrary object being accessed. This issue has been patched in version 3.288.1.
- Record
EUVD-2023-3109- CVSS 3.1
- 6.0 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-557v-xcg6-rm5m
Potential URI resolution path traversal in the AWS SDK for PHP
Impact
Within the scope of requests to S3 object keys and/or prefixes containing a Unix double-dot, a URI path traversal is possible. The issue exists in thebuildEndpoint method in the RestSerializer component of the AWS SDK for PHP v3 prior to 3.288.1. The buildEndpoint method relies on the Guzzle Psr7 UriResolver utility, which strips dot segments from the request path in accordance with RFC 3986. Under certain conditions, this could lead to an arbitrary object being accessed.
Versions of the AWS SDK for PHP v3 before 3.288.1 are affected by this issue.
Patches
Upgrade to the AWS SDK for PHP >= 3.288.1, if you are on version < 3.288.1.
References
RFC 3986 - https://datatracker.ietf.org/doc/html/rfc3986
For more information
If you have any questions or comments about this advisory, please contact AWS's Security team.
- Record
GHSA-557v-xcg6-rm5m- CVSS 3.1
- 6.0 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
NVD
AWS SDK for PHP is the Amazon Web Services software development kit for PHP. Within the scope of requests to S3 object keys and/or prefixes containing a Unix double-dot, a URI path traversal is possible. The issue exists in the buildEndpoint method in the RestSerializer component of the AWS SDK for PHP v3 prior to 3.288.1. The buildEndpoint method relies on the Guzzle Psr7 UriResolver utility, which strips dot segments from the request path in accordance with RFC 3986. Under certain conditions, this could lead to an arbitrary object being accessed. This issue has been patched in version 3.288.1.
- Record
CVE-2023-51651- CVSS 3.1
- 6.0 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N - CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSV
Potential URI resolution path traversal in the AWS SDK for PHP
AWS SDK for PHP is the Amazon Web Services software development kit for PHP. Within the scope of requests to S3 object keys and/or prefixes containing a Unix double-dot, a URI path traversal is possible. The issue exists in the buildEndpoint method in the RestSerializer component of the AWS SDK for PHP v3 prior to 3.288.1. The buildEndpoint method relies on the Guzzle Psr7 UriResolver utility, which strips dot segments from the request path in accordance with RFC 3986. Under certain conditions, this could lead to an arbitrary object being accessed. This issue has been patched in version 3.288.1.
- Record
CVE-2023-51651- CVSS 3.1
- 6.0 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSVCVE-2025-69820
Directory Traversal vulnerability in Beam beta9 v.0.1.521 allows a remote attacker to obtain sensitive information via the joinCleanPath function.
- Record
CVE-2025-69820- CVSS 3.1
- 6.0 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-04
Show 5 moreShow less
OSVGHSA-557v-xcg6-rm5m
Potential URI resolution path traversal in the AWS SDK for PHP
Impact
Within the scope of requests to S3 object keys and/or prefixes containing a Unix double-dot, a URI path traversal is possible. The issue exists in thebuildEndpoint method in the RestSerializer component of the AWS SDK for PHP v3 prior to 3.288.1. The buildEndpoint method relies on the Guzzle Psr7 UriResolver utility, which strips dot segments from the request path in accordance with RFC 3986. Under certain conditions, this could lead to an arbitrary object being accessed.
Versions of the AWS SDK for PHP v3 before 3.288.1 are affected by this issue.
Patches
Upgrade to the AWS SDK for PHP >= 3.288.1, if you are on version < 3.288.1.
References
RFC 3986 - https://datatracker.ietf.org/doc/html/rfc3986
For more information
If you have any questions or comments about this advisory, please contact AWS's Security team.
- Record
GHSA-557v-xcg6-rm5m- CVSS 3.1
- 6.0 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSVGHSA-73jg-4qh6-3f4g
Beam Exposes sensitive information via joinCleanPath function
Directory Traversal vulnerability in Beam beta9 v.0.1.552 allows a remote attacker to obtain sensitive information via the joinCleanPath function
- Record
GHSA-73jg-4qh6-3f4g- CVSS 3.1
- 6.0 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2023-51651
AWS SDK for PHP is the Amazon Web Services software development kit for PHP. Within the scope of requests to S3 object keys and/or prefixes containing a Unix double-dot, a URI path traversal is possible. The issue exists in the buildEndpoint method in the RestSerializer component of the AWS SDK for PHP v3 prior to 3.288.1. The buildEndpoint method relies on the Guzzle Psr7 UriResolver utility, which strips dot segments from the request path in accordance with RFC 3986. Under certain conditions, this could lead to an arbitrary object being accessed. This issue has been patched in version 3.288.1.
- Record
UBUNTU-CVE-2023-51651- CVSS 3.1
- 6.0 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N - CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVCLSA-2026-1769993567 No score
TuxCare security update for aws/aws-sdk-php (1 CVE)
TuxCare rebuilt aws/aws-sdk-php to address 1 CVE. Fixed in 3.263.4-p1+tuxcare.
- Record
CLSA-2026-1769993567- Updated
- 2026-11-02
OSVGO-2026-4390 No score
Beam Exposes sensitive information via joinCleanPath function in github.com/beam-cloud/beta9
Beam Exposes sensitive information via joinCleanPath function in github.com/beam-cloud/beta9
- Record
GO-2026-4390- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
aws/aws-sdk-phpPackagist |
before 3.288.1 | 3.288.1 |
aws/aws-sdk-phpTuxCare:Packagist |
3.263.4 up to 3.263.4-p1+tuxcare | 3.263.4-p1+tuxcare |
aws/aws-sdk-phpPackagist From an advisory covering 2 CVEs |
before 3.288.1, plus listed versions 2.0.02.0.12.0.22.0.32.1.0 Show 45 moreShow less2.1.12.1.22.2.02.2.12.3.02.3.12.3.22.3.32.3.42.4.02.4.12.4.102.4.112.4.122.4.22.4.32.4.42.4.52.4.62.4.72.4.82.4.92.5.02.5.12.5.22.5.32.5.42.6.02.6.12.6.102.6.112.6.122.6.132.6.142.6.152.6.162.6.22.6.32.6.42.6.52.6.62.6.72.6.82.6.92.7.0 |
3.288.1 |
github.com/beam-cloud/beta9Go From an advisory covering 2 CVEs |
through 0.0.0-20260116162221-c1cd75e813cf | None known |
github.com/beam-cloud/beta9Go From an advisory covering 2 CVEs |
All versions | None known |
aws-sdk-for-phpUbuntu:16.04:LTS |
All versions, plus listed versions 2.8.17-12.8.22-12.8.23-12.8.24-12.8.25-12.8.27-13.15.1-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| facts | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-51651 is a medium vulnerability (CVSS 6.0) in Amazon Aws Software Development Kit, published December 21, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.38%, the 31st percentile. Fixed in aws/aws-sdk-php 3.288.1.
References
github.com/aws/aws-sdk-php/security/advisories/GHSA-557v-xcg6-rm5m
nvd.nist.gov/vuln/detail/CVE-2023-51651
Show 10 moreShow less
ubuntu.com/security/CVE-2023-51651
cve.org/CVERecord?id=CVE-2023-51651
Left out here: 1,781 versions. The JSON record has them.