CVE-2025-24961

Insecure path traversal in filesystem and filesystem-nio2 storage backends in org.gaul S3Proxy

6.0 MediumFix available

org.gaul S3Proxy implements the S3 API and proxies requests. Users of the filesystem and filesystem-nio2 storage backends could unintentionally expose local files to users. This issue has been addressed in version 2.6.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

0.57%Up 0.5 points since Feb 4, 2025

What each source reports

CVE List Score used6.0

Insecure path traversal in filesystem and filesystem-nio2 storage backends in org.gaul S3Proxy

Record: CVE-2025-24961
CVSS 4.0: 6.0 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Weakness: CWE-22
Updated: 2026-11-02

EUVDEUVD-2025-02176.0

Record: EUVD-2025-0217
CVSS 4.0: 6.0 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Updated: 2026-11-03

GitHub AdvisoriesGHSA-2ccp-vqmv-4r4x6.9

S3Proxy allows insecure path traversal in filesystem and filesystem-nio2 storage backends

Impact

Users of the filesystem and filesystem-nio2 storage backends could unintentionally expose local files to authenticated clients.

Patches

Upgrade to S3Proxy 2.6.0 which includes apache/jclouds@b0819e0ef5e08c792a4d1724b938714ce9503aa3 and 86b6ee4749aa163a78e7898efc063617ed171980.

Workarounds

None

References

Privately reported by XBOW Team @xbow-security.

Record: GHSA-2ccp-vqmv-4r4x
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness: CWE-22
Updated: 2026-11-02

NVD6.0

Record: CVE-2025-24961
CVSS 4.0: 6.0 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness: CWE-22
Updated: 2026-11-02

OSV6.0

Insecure path traversal in filesystem and filesystem-nio2 storage backends in org.gaul S3Proxy

Record: CVE-2025-24961
CVSS 4.0: 6.0 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Weakness: CWE-22
Updated: 2026-11-11

OSVGHSA-2ccp-vqmv-4r4x6.9

S3Proxy allows insecure path traversal in filesystem and filesystem-nio2 storage backends

Impact

Users of the filesystem and filesystem-nio2 storage backends could unintentionally expose local files to authenticated clients.

Patches

Upgrade to S3Proxy 2.6.0 which includes apache/jclouds@b0819e0ef5e08c792a4d1724b938714ce9503aa3 and 86b6ee4749aa163a78e7898efc063617ed171980.

Workarounds

None

References

Privately reported by XBOW Team @xbow-security.

Record: GHSA-2ccp-vqmv-4r4x
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness: CWE-22
Updated: 2026-11-02

Affected products

gaul s3proxy

Affected packages

Affected packages
Package	Affected	Fixed
`org.gaul:s3proxy` Maven	before 2.6.0	2.6.0
`org.gaul:s3proxy` Maven	before 2.6.0, plus listed versions 1.3.01.4.01.5.01.5.11.5.2 Show 17 moreShow less 1.5.31.5.41.5.51.6.01.6.11.6.21.7.01.7.11.8.01.9.02.0.02.1.02.2.02.3.02.4.02.4.12.5.0	2.6.0

History

History
Recorded	Changed	Sources
Nov 11, 2026	facts	OSV
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-24961 is a medium vulnerability (CVSS 6.0) in Gaul S3proxy, published February 3, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.57%, the 47th percentile. Fixed in org.gaul:s3proxy 2.6.0.