CVE-2025-14761
Medium · 5.3CVSS
5.3
EPSS
0.2%
Published
Dec 17, 2025
CISA due date
—
The record
Missing cryptographic key commitment in the AWS SDK for PHP may allow a user with write access to the S3 bucket to introduce a new EDK that decrypts to different plaintext when the encrypted data key is stored in an "instruction file" instead of S3's metadata record. To mitigate this issue, upgrade AWS SDK for PHP to version 3.368.0 or later
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | aws/aws-sdk-php | 0 | 3.368.0 |
| Chainguard | nextcloud-server-30-apache2-config | 0 | 30.0.17-r0 |
| Chainguard | nextcloud-server-31 | 0 | 31.0.13-r0 |
| Chainguard | nextcloud-server-31-apache2-config | 0 | 31.0.12-r0 |
| Chainguard | nextcloud-server-32 | 0 | 32.0.4-r0 |
| Chainguard | nextcloud-server-32-apache2-config | 0 | 32.0.3-r0 |
| Wolfi | nextcloud-server-31 | 0 | 31.0.13-r0 |
| Wolfi | nextcloud-server-31-apache2-config | 0 | 31.0.12-r0 |
| Wolfi | nextcloud-server-32 | 0 | 32.0.4-r0 |
| Wolfi | nextcloud-server-32-apache2-config | 0 | 32.0.3-r0 |
Related vulnerabilities
- CVE-2025-69820 Directory Traversal vulnerability in Beam beta9 v.0.1.521 allows a remote attacker to… Also affects aws/aws-sdk-php
- CVE-2025-66552 Nextcloud Server admin_audit does not log all actions on files in groupfolders Also affects nextcloud-server-30-apache2-config
- CVE-2025-66547 Nextcloud Server users can modify tags on files that do not belong to them Also affects nextcloud-server-30-apache2-config
- CVE-2025-66510 Nextcloud Server Contacts Search allowed users to retrieve contact information of other… Also affects nextcloud-server-30-apache2-config
- CVE-2025-64500 Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass Also affects nextcloud-server-30-apache2-config
- CVE-2026-30964 web-auth/webauthn-lib is an open source set of PHP libraries and a Symfony bundle to… Also affects nextcloud-server-31
- CVE-2026-24739 Symfony is a PHP framework for web and console applications and a set of reusable PHP… Also affects nextcloud-server-31
- CVE-2026-81822 The vulnerability, if exploited, could allow a miscreant with read access to PIMBoards… CWE-327