Skip to content
Fencer Vulns
high 8.2

CVE-2025-27088 json

Reflected Cross-site Scripting (XSS) in template implementation in oxyno-zeta/s3-proxy

published 2025-02-20 20 mo ago modified 2026-09-10 1 mo ago also GHSA-pp9m-qf39-hxjc , GO-2025-3477 , EUVD-2025-4517

cvss
8.2
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 42%
public exploits
0
none known

Summary

oxyno-zeta/s3-proxy is an aws s3 proxy written in go. In affected versions a Reflected Cross-site Scripting (XSS) vulnerability enables attackers to create malicious URLs that, when visited, inject scripts into the web application. This can lead to session hijacking or phishing attacks on a trusted domain, posing a moderate risk to all users. It's possible to inject html elements, including scripts through the folder-list template. The affected template allows users to interact with the URL path provided by the `Request.URL.Path` variable, which is then rendered directly into the HTML without proper sanitization or escaping. This can be abused by attackers who craft a malicious URL containing injected HTML or JavaScript. When users visit such a URL, the malicious script will be executed in the user's context. This issue has been addressed in version 4.18.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Patch / fix

  • go github.com/oxyno-zeta/s3-proxy/cmd/s3-proxy 0.0.0-20250220214310-c611c741ed48
  • go github.com/oxyno-zeta/s3-proxy 0.0.0-20250220214310-c611c741ed48
  • oxyno-zeta s3-proxy 2.23.1, 4.18.1
  • govulncheck-vulndb openSUSE Tumbleweed 0.0.20250312T181707-1.1

opensuse advisories openSUSE-SU-2025:14889-1

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
20 mo ago

Exploit prediction

0.50% chance of exploitation in the next 30 days, higher than 42% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/oxyno-zeta/s3-proxy/security/advisories/GHSA-pp9m-qf39-hxjc referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 4.0 8.4 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N
CNA 4.0 8.4 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD 3.1 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

Affected packages

ecosystem package affected fixed in
go github.com/oxyno-zeta/s3-proxy/cmd/s3-proxy
<0.0.0-20250220214310-c611c741ed48
0.0.0-20250220214310-c611c741ed48
go github.com/oxyno-zeta/s3-proxy
<0.0.0-20250220214310-c611c741ed48
0.0.0-20250220214310-c611c741ed48

Affected products

  • oxyno-zeta s3-proxy

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.