Go/github.com/oxyno-zeta/s3-proxy/cmd/s3-proxy CVE-2025-27088: high 8.2, EPSS 0.50%

S3-Proxy allows Reflected Cross-site Scripting (XSS) in template implementation

Action: Upgrade github.com/oxyno-zeta/s3-proxy/cmd/s3-proxy to 0.0.0-20250220214310-c611c741ed48 or later.

go get github.com/oxyno-zeta/s3-proxy/cmd/s3-proxy@v0.0.0-20250220214310-c611c741ed48

Affected

Fixed versions

Sources

• osv: GHSA-pp9m-qf39-hxjc
• nvd: CVE-2025-27088
• https://github.com/oxyno-zeta/s3-proxy/security/advisories/GHSA-pp9m-qf39-hxjc
• https://github.com/oxyno-zeta/s3-proxy/commit/c611c741ed4872ea3f46232be23bb830f96f9564
• https://github.com/oxyno-zeta/s3-proxy
• https://github.com/oxyno-zeta/s3-proxy/blob/master/templates/folder-list.tpl#L19C21-L19C38
• https://github.com/oxyno-zeta/s3-proxy/releases/tag/v4.18.1

CVE-2025-27088 · published 2025-02-20T22:18:46Z · modified 2026-09-10T03:50:22.862610277Z · JSON