PyTorch security vulnerabilities

PyTorch is a Python package open-sourced by PyTorch. PyTorch has a security vulnerability that stems from the uploadresultstos3.sh script not ensuring S3 bucket ownership, which could lead to data disclosure or unauthorized access...

PT-2025-12164

Name of the Vulnerable Software and Affected Versions stangirard/quivr affected versions not specified Description A path traversal issue exists, allowing an attacker to upload files to arbitrary paths in an S3 bucket by manipulating the file path in the upload request. This enables unauthorized...

CVE-2024-6583: Relative Path Traversal

A path traversal vulnerability exists in the latest version of stangirard/quivr. This vulnerability allows an attacker to upload files to arbitrary paths in an S3 bucket by manipulating the file path in the upload request...

Security Bulletin: An unclaimed Amazon S3 bucket vulnerability (CVE-2024-1682)affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component.

Summary Potential unclaimed Amazon S3 bucket vulnerability CVE-2024-1682 has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. The vulnerability have been addressed. Refer to details for...

CVE-2025-27136

LocalS3 is an Amazon S3 mock service for testing and local development. Prior to version 1.21, the LocalS3 service's bucket creation endpoint is vulnerable to XML External Entity XXE injection. When processing the CreateBucketConfiguration XML document during bucket creation, the service's XML...

XML External Entity (XXE) Injection

Overview Affected versions of this package are vulnerable to XML External Entity XXE Injection over the bucket creation endpoint. In createServiceFactory, external entities referenced in the CreateBucketConfiguration XML document are resolved and retrieved. This allows attackers to perform...

GHSA-V232-254C-M6P7 LocalS3 Project Vulnerable to XML External Entity (XXE) Injection via Bucket Tagging API

Description The LocalS3 project, an S3-compatible storage service, is vulnerable to XML External Entity XXE injection through its bucket tagging API. The vulnerability exists because the application processes XML input without properly disabling external entity resolution. When processing XML dat...

XML External Entity (XXE) Injection

Overview Affected versions of this package are vulnerable to XML External Entity XXE Injection over the bucket tagging endpoint. External entities referenced in a malicious XML document are resolved and retrieved. This allows attackers to expose information from internal URLs that are not meant t...

LocalS3 Project Vulnerable to XML External Entity (XXE) Injection via Bucket Tagging API

Description The LocalS3 project, an S3-compatible storage service, is vulnerable to XML External Entity XXE injection through its bucket tagging API. The vulnerability exists because the application processes XML input without properly disabling external entity resolution. When processing XML dat...

XML External Entity (XXE) Injection

Overview Affected versions of this package are vulnerable to XML External Entity XXE Injection over the bucket tagging endpoint. External entities referenced in an AccessControlPolicy XML document are resolved and retrieved. This allows attackers to perform server-side request forgery SSRF attack...

LocalS3 Project Bucket Operations Vulnerable to XML External Entity (XXE) Injection

Description The LocalS3 project contains an XML External Entity XXE Injection vulnerability in its bucket operations that process XML data. Specifically, the vulnerability exists in the bucket ACL and bucket tagging operations. The application processes XML input without properly disabling extern...

GHSA-2466-4485-4PXJ LocalS3 Project Bucket Operations Vulnerable to XML External Entity (XXE) Injection

Description The LocalS3 project contains an XML External Entity XXE Injection vulnerability in its bucket operations that process XML data. Specifically, the vulnerability exists in the bucket ACL and bucket tagging operations. The application processes XML input without properly disabling extern...

CVE-2025-27136 LocalS3 CreateBucketConfiguration Endpoint XML External Entity (XXE) Injection

LocalS3 is an Amazon S3 mock service for testing and local development. Prior to version 1.21, the LocalS3 service's bucket creation endpoint is vulnerable to XML External Entity XXE injection. When processing the CreateBucketConfiguration XML document during bucket creation, the service's XML...

CVE-2025-27136 LocalS3 CreateBucketConfiguration Endpoint XML External Entity (XXE) Injection

LocalS3 is an Amazon S3 mock service for testing and local development. Prior to version 1.21, the LocalS3 service's bucket creation endpoint is vulnerable to XML External Entity XXE injection. When processing the CreateBucketConfiguration XML document during bucket creation, the service's XML...

CVE-2025-27136 LocalS3 CreateBucketConfiguration Endpoint XML External Entity (XXE) Injection

LocalS3 is an Amazon S3 mock service for testing and local development. Prior to version 1.21, the LocalS3 service's bucket creation endpoint is vulnerable to XML External Entity XXE injection. When processing the CreateBucketConfiguration XML document during bucket creation, the service's XML...

CVE-2025-27136

CVE-2025-27136 concerns LocalS3, a local S3 mock service. Multiple connected sources confirm that before version 1.21, the bucket creation endpoint processes CreateBucketConfiguration with an XML parser that resolves external entities. An attacker can declare an external entity to reference an in...

GHSA-G6WM-2V64-WQ36 LocalS3 CreateBucketConfiguration Endpoint XML External Entity (XXE) Injection

Description The LocalS3 service's bucket creation endpoint is vulnerable to XML External Entity XXE injection. When processing the CreateBucketConfiguration XML document during bucket creation, the service's XML parser is configured to resolve external entities. This allows an attacker to declare...

LocalS3 CreateBucketConfiguration Endpoint XML External Entity (XXE) Injection

Description The LocalS3 service's bucket creation endpoint is vulnerable to XML External Entity XXE injection. When processing the CreateBucketConfiguration XML document during bucket creation, the service's XML parser is configured to resolve external entities. This allows an attacker to declare...

PT-2025-10709

Description The LocalS3 project contains an XML External Entity XXE Injection vulnerability in its bucket operations that process XML data. Specifically, the vulnerability exists in the bucket ACL and bucket tagging operations. The application processes XML input without properly disabling extern...

PT-2025-10712

Description The LocalS3 project, an S3-compatible storage service, is vulnerable to XML External Entity XXE injection through its bucket tagging API. The vulnerability exists because the application processes XML input without properly disabling external entity resolution. When processing XML dat...