What’s Vulnerable › Vulnerabilities

CVE-2021-32061

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-11-29 · updated 2026-06-17
• Weakness: CWE-22

Description

S3Scanner before 2.0.2 allows Directory Traversal via a crafted bucket, as demonstrated by a <Key>../ substring in a ListBucketResult element.

Affected products

• S3Scanner Project S3Scanner: before 2.0.2 — fixed in 2.0.2

How to fix

Upgrade to a fixed version: S3Scanner Project S3Scanner 2.0.2. Check the vendor advisory for mitigations.

References

• https://github.com/sa7mon/S3Scanner/issues/122
• https://github.com/sa7mon/S3Scanner/releases/tag/2.0.2
• https://vuln.ryotak.me/advisories/62
• https://github.com/sa7mon/S3Scanner/issues/122
• https://github.com/sa7mon/S3Scanner/releases/tag/2.0.2
• https://vuln.ryotak.me/advisories/62

Get alerted when CVE-2021-32061 or the next vulnerability affects your stack