{"cve":"CVE-2023-51651","nvd":{"published":"2023-12-22T21:15:09.700","modified":"2026-06-17T06:41:24.260","status":"Modified","description":"AWS SDK for PHP is the Amazon Web Services software development kit for PHP. Within the scope of requests to S3 object keys and/or prefixes containing a Unix double-dot, a URI path traversal is possible. The issue exists in the `buildEndpoint` method in the RestSerializer component of the AWS SDK for PHP v3 prior to 3.288.1. The `buildEndpoint` method relies on the Guzzle Psr7 UriResolver utility, which strips dot segments from the request path in accordance with RFC 3986. Under certain conditions, this could lead to an arbitrary object being accessed. This issue has been patched in version 3.288.1.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","score":3.3},"cwes":["CWE-22"],"references":["https://github.com/aws/aws-sdk-php/commit/aebc9f801438746ac4ade327551576cb75f635f2","https://github.com/aws/aws-sdk-php/releases/tag/3.288.1","https://github.com/aws/aws-sdk-php/security/advisories/GHSA-557v-xcg6-rm5m","https://github.com/aws/aws-sdk-php/commit/aebc9f801438746ac4ade327551576cb75f635f2","https://github.com/aws/aws-sdk-php/releases/tag/3.288.1"],"products":["amazon:aws_software_development_kit"],"source":"nvd","synced_at":"2026-10-19T21:43:38.875533635+00:00"},"epss":{"cve":"CVE-2023-51651","score":0.00376,"percentile":0.31628,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-73jg-4qh6-3f4g","url":"https://osv.dev/vulnerability/GHSA-73jg-4qh6-3f4g","summary":"Beam Exposes sensitive information via joinCleanPath function","modified":"2026-02-04T07:36:06.785913Z","packages":[{"ecosystem":"Go","name":"github.com/beam-cloud/beta9","purl":"pkg:golang/github.com/beam-cloud/beta9","ranges":["<=0.0.0-20260116162221-c1cd75e813cf"],"fixed":[]}]},{"id":"GO-2026-4390","url":"https://osv.dev/vulnerability/GO-2026-4390","summary":"Beam Exposes sensitive information via joinCleanPath function in github.com/beam-cloud/beta9","modified":"2026-02-04T07:36:06.785913Z","packages":[{"ecosystem":"Go","name":"github.com/beam-cloud/beta9","purl":"pkg:golang/github.com/beam-cloud/beta9","ranges":["all versions"],"fixed":[]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}