Cloudanix VulnDB

GHSA-27qh-8cxx-2cr5

Critical · 9.3

AWS SDK for PHP has CloudFront Policy Document Injection via Special Characters

CVSS

9.3

EPSS

—

Published

Mar 27, 2026

CISA due date

—

The record

This notification is related to the [CloudFront signing utilities](https://github.com/aws/aws-sdk-php/blob/master/src/CloudFront/Signer.php) in the AWS SDK for PHP, which are used to generate Amazon CloudFront signed URLs and signed cookies. A defense-in-depth enhancement has been implemented to improve handling of special characters, such as double quotes and backslashes, in input values.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities