{"id":"CVE-2022-31159","summary":"Partial Path Traversal in com.amazonaws:aws-java-sdk-s3 ","details":"The AWS SDK for Java enables Java developers to work with Amazon Web Services. A partial-path traversal issue exists within the `downloadDirectory` method in the AWS S3 TransferManager component of the AWS SDK for Java v1 prior to version 1.12.261. Applications using the SDK control the `destinationDirectory` argument, but S3 object keys are determined by the application that uploaded the objects. The `downloadDirectory` method allows the caller to pass a filesystem object in the object key but contained an issue in the validation logic for the key name. A knowledgeable actor could bypass the validation logic by including a UNIX double-dot in the bucket key. Under certain conditions, this could permit them to retrieve a directory from their S3 bucket that is one level up in the filesystem from their working directory. This issue’s scope is limited to directories whose name prefix matches the destinationDirectory. E.g. for destination directory`/tmp/foo`, the actor can cause a download to `/tmp/foo-bar`, but not `/tmp/bar`. If `com.amazonaws.services.s3.transfer.TransferManager::downloadDirectory` is used to download an untrusted buckets contents, the contents of that bucket can be written outside of the intended destination directory. Version 1.12.261 contains a patch for this issue. As a workaround, when calling `com.amazonaws.services.s3.transfer.TransferManager::downloadDirectory`, pass a `KeyFilter` that forbids `S3ObjectSummary` objects that `getKey` method return a string containing the substring `..` .","aliases":["GHSA-c28r-hw5m-5gv3"],"modified":"2026-08-12T03:51:34.348353110Z","published":"2022-07-15T17:45:12Z","database_specific":{"cwe_ids":["CWE-22"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31159.json","cna_assigner":"GitHub_M"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31159.json"},{"type":"ADVISORY","url":"https://github.com/aws/aws-sdk-java/security/advisories/GHSA-c28r-hw5m-5gv3"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-31159"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/aws/aws-sdk-java","events":[{"introduced":"0"},{"last_affected":"5555d847a882d4c3094b00ac7cec21a16cf01a3e"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"last_affected":"1.12.260"}],"source":["AFFECTED_FIELD","CPE_RANGE"],"cpe":"cpe:2.3:a:amazon:aws-sdk-java:*:*:*:*:*:*:*:*"}}],"versions":["1.12.260","1.12.259","1.12.258","1.12.257","1.12.256","1.12.255","1.12.254","1.12.253","1.12.252","1.12.251","1.12.250","1.12.249","1.12.248","1.12.247","1.12.246","1.12.245","1.12.244","1.12.243","1.12.242","1.12.241","1.11.997","1.12.240","1.12.239","1.12.238","1.12.237","1.12.236","1.12.235","1.12.234","1.12.233","1.12.232","1.12.231","1.12.230","1.12.229","1.12.228","1.12.227","1.12.226","1.12.225","1.12.224","1.12.223","1.12.222","1.12.221","1.12.220","1.12.219","1.12.218","1.12.217","1.12.216","1.12.215","1.12.214","1.12.213","1.12.212","1.12.211","1.12.210","1.12.209","1.12.208","1.12.207","1.12.206","1.12.205","1.12.204","1.12.203","1.12.202","1.12.201","1.12.200","1.12.199","1.12.198","1.12.197","1.12.196","1.12.195","1.12.194","1.12.193","1.12.192","1.12.191","1.12.190","1.12.189","1.12.188","1.12.187","1.12.186","1.12.185","1.12.184","1.12.183","1.12.182","1.12.181","1.12.180","1.12.179","1.12.178","1.12.177","1.12.176","1.12.175","1.12.174","1.12.173","1.12.172","1.12.171","1.12.170","1.12.169","1.12.168","1.12.167","1.12.166","1.12.165","1.12.164","1.12.163","1.12.162","1.12.161","1.12.160","1.12.159","1.12.158","1.12.157","1.12.156","1.12.155","1.12.154","1.12.153","1.12.152","1.12.151","1.12.150","1.12.149","1.12.148","1.12.147","1.12.146","1.12.145","1.12.144","1.12.143","1.12.142","1.12.141","1.12.140","1.12.139","1.12.138","1.12.137","1.12.136","1.12.135","1.12.134","1.12.133","1.12.132","1.12.131","1.12.130","1.12.129","1.12.128","1.12.127","1.12.126","1.12.125","1.12.124","1.12.123","1.12.122","1.12.121","1.12.120","1.12.119","1.12.118","1.12.117","1.12.116","1.12.115","1.12.114","1.12.113","1.12.112","1.12.111","1.12.110","1.12.109","1.12.108","1.12.107","1.12.106","1.12.105","1.12.104","1.12.103","1.12.102","1.12.101","1.12.100","1.12.99","1.12.98","1.12.97","1.12.96","1.12.95","1.12.94","1.12.93","1.12.92","1.12.91","1.12.90","1.12.89","1.12.88","1.12.87","1.12.86","1.12.85","1.12.84","1.12.83","1.12.82","1.12.81","1.12.80","1.12.79","1.12.78","1.12.77","1.12.76","1.12.75","1.12.74","1.12.73","1.12.72","1.12.71","1.12.70","1.12.69","1.12.68","1.12.67","1.12.66","1.12.65","1.12.64","1.12.63","1.12.62","1.12.61","1.12.60","1.12.59","1.12.58","1.12.57","1.12.56","1.12.55","1.12.54","1.12.53","1.12.52","1.12.51","1.12.50","1.12.49","1.12.48","1.12.47","1.12.46","1.12.45","1.12.44","1.12.43","1.12.42","1.12.41","1.12.40","1.12.39","1.12.38","1.12.37","1.12.36","1.12.35","1.12.34","1.12.33","1.12.32","1.12.31","1.12.30","1.12.29","1.12.28","1.12.27","1.12.26","1.12.25","1.12.24","1.12.23","1.12.22","1.12.21","1.12.20","1.12.19","1.12.18","1.12.17","1.12.16","1.12.15","1.12.14","1.12.13","1.12.12","1.12.11","1.12.10","1.12.9","1.12.8","1.12.7","1.12.6","1.12.5","1.12.4","1.12.3","1.12.2","1.12.1","1.11.1034","1.11.1033","1.11.1032","1.11.1031","1.11.1030","1.11.1029","1.11.1028","1.11.1027","1.11.1026","1.11.1025","1.11.1024","1.11.1023","1.11.1022","1.11.1021","1.11.1020","1.11.1019","1.11.1018","1.11.1017","1.11.1016","1.11.1015","1.11.1014","1.11.1013","1.11.1012","1.11.1011","1.11.1010","1.11.1009","1.11.1008","1.11.1007","1.11.1006","1.11.1005","1.11.1004","1.11.1003","1.11.1002","1.11.1001","1.11.1000","1.11.999","1.11.998","1.11.996","1.11.995","1.11.994","1.11.993","1.11.992","1.11.991","1.11.990","1.11.989","1.11.988","1.11.987","1.11.986","1.11.985","1.11.984","1.11.983","1.11.982","1.11.981","1.11.980","1.11.979","1.11.978","1.11.977","1.11.976","1.11.975","1.11.974","1.11.973","1.11.972","1.11.971","1.11.970","1.11.969","1.11.968","1.11.967","1.11.966","1.11.965","1.11.964","1.11.963","1.11.962","1.11.961","1.11.960","1.11.959","1.11.958","1.11.957","1.11.956","1.11.955","1.11.954","1.11.953","1.11.952","1.11.951","1.11.950","1.11.949","1.11.948","1.11.947","1.11.946","1.11.945","1.11.944","1.11.943","1.11.942","1.11.941","1.11.940","1.11.939","1.11.938","1.11.937","1.11.936","1.11.935","1.11.934","1.11.933","1.11.932","1.11.931","1.11.930","1.11.929","1.11.928","1.11.927","1.11.926","1.11.925","1.11.924","1.11.923","1.11.922","1.11.921","1.11.920","1.11.919","1.11.918","1.11.917","1.11.916","1.11.915","1.11.914","1.11.913","1.11.912","1.11.911","1.11.910","1.11.909","1.11.908","1.11.907","1.11.906","1.11.905","1.11.904","1.11.903","1.11.902","1.11.901","1.11.900","1.11.899","1.11.898","1.11.897","1.11.896","1.11.895","1.11.894","1.11.893","1.11.892","1.11.891","1.11.890","1.11.889","1.11.888","1.11.887","1.11.886","1.11.885","1.11.884","1.11.883","1.11.882","1.11.881","1.11.880","1.11.879","1.11.878","1.11.877","1.11.876","1.11.875","1.11.874","1.11.873","1.11.872","1.11.871","1.11.870","1.11.869","1.11.868","1.11.867","1.11.866","1.11.865","1.11.864","1.11.863","1.11.862","1.11.861","1.11.860","1.11.859","1.11.858","1.11.857","1.11.856","1.11.855","1.11.854","1.11.853","1.11.852","1.11.851","1.11.850","1.11.849","1.11.848","1.11.847","1.11.846","1.11.845","1.11.844","1.11.842","1.11.841","1.11.840","1.11.839","1.11.838","1.11.837","1.11.836","1.11.835","1.11.834","1.11.833","1.11.832","1.11.831","1.11.830","1.11.829","1.11.828","1.11.827","1.11.826","1.11.825","1.11.824","1.11.823","1.11.822","1.11.821","1.11.820","1.11.819","1.11.818","1.11.817","1.11.816","1.11.815","1.11.814","1.11.813","1.11.812","1.11.811","1.11.810","1.11.809","1.11.808","1.11.807","1.11.806","1.11.805","1.11.804","1.11.803","1.11.802","1.11.801","1.11.800","1.11.799","1.11.798","1.11.797","1.11.796","1.11.795","1.11.794","1.11.793","1.11.792","1.11.791","1.11.790","1.11.789","1.11.788","1.11.787","1.11.786","1.11.785","1.11.784","1.11.783","1.11.782","1.11.781","1.11.780","1.11.779","1.11.778","1.11.777","1.11.776","1.11.775","1.11.774","1.11.773","1.11.772","1.11.771","1.11.770","1.11.769","1.11.768","1.11.767","1.11.766","1.11.765","1.11.764","1.11.763","1.11.762","1.11.761","1.11.760","1.11.759","1.11.757","1.11.756","1.11.755","1.11.754","1.11.753","1.11.752","1.11.751","1.11.750","1.11.749","1.11.748","1.11.747","1.11.746","1.11.745","1.11.744","1.11.743","1.11.742","1.11.741","1.11.740","1.11.739","1.11.738","1.11.737","1.11.736","1.11.735","1.11.734","1.11.733","1.11.732","1.11.731","1.11.730","1.11.729","1.11.728","1.11.727","1.11.726","1.11.725","1.11.724","1.11.723","1.11.722","1.11.721","1.11.720","1.11.719","1.11.718","1.11.717","1.11.716","1.11.715","1.11.714","1.11.713","1.11.712","1.11.711","1.11.710","1.11.709","1.11.708","1.11.707","1.11.706","1.11.705","1.11.704","1.11.703","1.11.702","1.11.701","1.11.700","1.11.699","1.11.698","1.11.697","1.11.696","1.11.695","1.11.694","1.11.693","1.11.692","1.11.691","1.11.690","1.11.689","1.11.688","1.11.687","1.11.686","1.11.685","1.11.684","1.11.683","1.11.682","1.11.681","1.11.680","1.11.679","1.11.678","1.11.677","1.11.676","1.11.675","1.11.674","1.11.673","1.11.672","1.11.671","1.11.670","1.11.669","1.11.668","1.11.667","1.11.666","1.11.665","1.11.664","1.11.663","1.11.662","1.11.661","1.11.660","1.11.659","1.11.658","1.11.657","1.11.656","1.11.655","1.11.654","1.11.653","1.11.652","1.11.651","1.11.650","1.11.649","1.11.648","1.11.647","1.11.646","1.11.645","1.11.644","1.11.643","1.11.642","1.11.641","1.11.640","1.11.639","1.11.638","1.11.637","1.11.636","1.11.635","1.11.634","1.11.633","1.11.632","1.11.631","1.11.630","1.11.629","1.11.628","1.11.627","1.11.626","1.11.625","1.11.624","1.11.623","1.11.622","1.11.621","1.11.620","1.11.619","1.11.618","1.11.617","1.11.616","1.11.615","1.11.614","1.11.613","1.11.612","1.11.611","1.11.610","1.11.609","1.11.608","1.11.607","1.11.606","1.11.605","1.11.604","1.11.603","1.11.602","1.11.601","1.11.600","1.11.599","1.11.598","1.11.597","1.11.596","1.11.595","1.11.594","1.11.593","1.11.592","1.11.591","1.11.590","1.11.589","1.11.588","1.11.587","1.11.586","1.11.585","1.11.584","1.11.583","1.11.582","1.11.581","1.11.580","1.11.579","1.11.578","1.11.577","1.11.576","1.11.575","1.11.574","1.11.573","1.11.572","1.11.571","1.11.570","1.11.569","1.11.568","1.11.567","1.11.566","1.11.565","1.11.564","1.11.563","1.11.562","1.11.561","1.11.560","1.11.559","1.11.558","1.11.557","1.11.556","1.11.555","1.11.554","1.11.553","1.11.552","1.11.551","1.11.550","1.11.549","1.11.548","1.11.547","1.11.546","1.11.545","1.11.544","1.11.543","1.11.542","1.11.541","1.11.540","1.11.539","1.11.538","1.11.537","1.11.536","1.11.535","1.11.534","1.11.533","1.11.532","1.11.531","1.11.530","1.11.529","1.11.528","1.11.527","1.11.526","1.11.525","1.11.524","1.11.523","1.11.522","1.11.521","1.11.520","1.11.519","1.11.518","1.11.517","1.11.516","1.11.515","1.11.514","1.11.513","1.11.512","1.11.511","1.11.510","1.11.509","1.11.508","1.11.507","1.11.506","1.11.505","1.11.504","1.11.503","1.11.502","1.11.501","1.11.500","1.11.499","1.11.498","1.11.497","1.11.496","1.11.495","1.11.494","1.11.493","1.11.492","1.11.491","1.11.490","1.11.489","1.11.488","1.11.487","1.11.486","1.11.485","1.11.484","1.11.483","1.11.482","1.11.481","1.11.480","1.11.479","1.11.478","1.11.477","1.11.476","1.11.475","1.11.474","1.11.473","1.11.472","1.11.471","1.11.470","1.11.469","1.11.468","1.11.467","1.11.466","1.11.465","1.11.464","1.11.463","1.11.462","1.11.461","1.11.460","1.11.459","1.11.458","1.11.457","1.11.456","1.11.455","1.11.454","1.11.453","1.11.452","1.11.451","1.11.450","1.11.449","1.11.448","1.11.447","1.11.446","1.11.445","1.11.444","1.11.443","1.11.442","1.11.441","1.11.440","1.11.439","1.11.438","1.11.437","1.11.436","1.11.435","1.11.434","1.11.433","1.11.432","1.11.431","1.11.430","1.11.429","1.11.428","1.11.427","1.11.426","1.11.425","1.11.424","1.11.423","1.11.422","1.11.421","1.11.420","1.11.419","1.11.418","1.11.417","1.11.416","1.11.415","1.11.414","1.11.413","1.11.412","1.11.411","1.11.410","1.11.409","1.11.408","1.11.407","1.11.406","1.11.405","1.11.404","1.11.403","1.11.402","1.11.401","1.11.400","1.11.399","1.11.398","1.11.397","1.11.396","1.11.395","1.11.394","1.11.393","1.11.392","1.11.391","1.11.390","1.11.389","1.11.388","1.11.387","1.11.386","1.11.385","1.11.384","1.11.383","1.11.382","1.11.381","1.11.380","1.11.379","1.11.378","1.11.377","1.11.376","1.11.375","1.11.374","1.11.373","1.11.372","1.11.371","1.11.370","1.11.369","1.11.368","1.11.367","1.11.366","1.11.365","1.11.364","1.11.363","1.11.362","1.11.361","1.11.360","1.11.359","1.11.358","1.11.357","1.11.356","1.11.355","1.11.354","1.11.353","1.11.352","1.11.351","1.11.350","1.11.349","1.11.348","1.11.347","1.11.346","1.11.345","1.11.344","1.11.343","1.11.342","1.11.341","1.11.340","1.11.339","1.11.338","1.11.337","1.11.336","1.11.335","1.11.334","1.11.333","1.11.332","1.11.331","1.11.330","1.11.329","1.11.328","1.11.327","1.11.326","1.11.325","1.11.324","1.11.323","1.11.322","1.11.321","1.11.320","1.11.319","1.11.318","1.11.317","1.11.316","1.11.315","1.11.314","1.11.313","1.11.312","1.11.311","1.11.310","1.11.309","1.11.308","1.11.307","1.11.306","1.11.305","1.11.304","1.11.303","1.11.302","1.11.301","1.11.300","1.11.299","1.11.298","1.11.297","1.11.296","1.11.295","1.11.294","1.11.293","1.11.292","1.11.291","1.11.290","1.11.289","1.11.288","1.11.287","1.11.286","1.11.285","1.11.284","1.11.283","1.11.282","1.11.281","1.11.280","1.11.279","1.11.278","1.11.277","1.11.276","1.11.275","1.11.274","1.11.273","1.11.272","1.11.271","1.11.270","1.11.269","1.11.268","1.11.267","1.11.266","1.11.265","1.11.264","1.11.263","1.11.262","1.11.261","1.11.260","1.11.259","1.11.258","1.11.257","1.11.256","1.11.255","1.11.254","1.11.253","1.11.252","1.11.251","1.11.250","1.11.249","1.11.248","1.11.247","1.11.246","1.11.245","1.11.244","1.11.243","1.11.242","1.11.241","1.11.240","1.11.239","1.11.238","1.11.237","1.11.236","1.11.235","1.11.234","1.11.233","1.11.232","1.11.231","1.11.230","1.11.229","1.11.228","1.11.227","1.11.226","1.11.225","1.11.224","1.11.223","1.11.222","1.11.221","1.11.220","1.11.219","1.11.218","1.11.217","1.11.216","1.11.215","1.11.214","1.11.213","1.11.212","1.11.211","1.11.210","1.11.209","1.11.208","1.11.207","1.11.206","1.11.205","1.11.204","1.11.203","1.11.202","1.11.201","1.11.200","1.11.199","1.11.198","1.11.197","1.11.196","1.11.195","1.11.194","1.11.193","1.11.192","1.11.191","1.11.190","1.11.189","1.11.188","1.11.187","1.11.186","1.11.185","1.11.184","1.11.183","1.11.182","1.11.181","1.11.180","1.11.179","1.11.178","1.11.177","1.11.176","1.11.175","1.11.174","1.11.173","1.11.172","1.11.171","1.11.170","1.11.169","1.11.168","1.11.167","1.11.166","1.11.165","1.11.164","1.11.163","1.11.162","1.11.161","1.11.160","1.11.159","1.11.158","1.11.157","1.11.156","1.11.155","1.11.154","1.11.153","1.11.152","1.11.151","1.11.150","1.11.149","1.11.148","1.11.147","1.11.146","1.11.145","1.11.144","1.11.143","1.11.142","1.11.141","1.11.140","1.11.139","1.11.138","1.11.137","1.11.136","1.11.135","1.11.134","1.11.133","1.11.132","1.11.131","1.11.130","1.11.129","1.11.128","1.11.127","1.11.126","1.11.125","1.11.124","1.11.123","1.11.122","1.11.121","1.11.120","1.11.119","1.11.118","1.11.117","1.11.116","1.11.115","1.11.114","1.11.113","1.11.112","1.11.111","1.11.110","1.11.109","1.11.108","1.11.107","1.11.106","1.11.105","1.11.104","1.11.103","1.11.102","1.11.101","1.11.100","1.11.99","1.11.98","1.11.97","1.11.96","1.11.95","1.11.94","1.11.93","1.11.92","1.11.91","1.11.90","1.11.89","1.11.88","1.11.87","1.11.86","1.11.85","1.11.84","1.11.83","1.11.82","1.11.81","1.11.80","1.11.79","1.11.78","1.11.77","1.11.76","1.11.75","1.11.74","1.11.73","1.11.72","1.11.71","1.11.70","1.11.69","1.11.68","1.11.67","1.11.66","1.11.65","1.11.64","1.11.63","1.11.62","1.11.61","1.11.60","1.11.59","1.11.58","1.11.57","1.11.56","1.11.55","1.11.54","1.11.53","1.11.52","1.11.51","1.11.50","1.11.49","1.11.48","1.11.47","1.11.46","1.11.45","1.11.44","1.11.43","1.11.42","1.11.41","1.11.40","1.10.64","1.11.39","1.11.38","1.10.75","1.11.37","1.11.36","1.11.34","1.11.35","1.11.33","1.11.32","1.11.31","1.11.30","1.11.29","1.11.28","1.11.27","1.11.26","1.11.25","1.11.24","1.11.23","1.11.22","1.11.21","1.11.20","1.11.19","1.11.18","1.11.17","1.11.16","1.11.15","1.11.14","1.11.13","1.11.12","1.11.11","1.11.10","1.11.9","1.11.8","1.11.7","1.11.6","1.7.4","1.11.5","1.11.4","1.11.3","1.11.2","1.11.1","1.11.0","1.10.77","1.10.76","1.10.74","1.10.73","1.10.72","1.10.71","1.10.70","1.10.69","1.10.68","1.10.67","1.10.66","1.10.65","1.10.63","1.10.62","1.10.61","1.10.60","1.10.59","1.10.58","1.10.57","1.10.56","1.10.55","1.10.53","1.10.51","1.10.50","1.10.49","1.10.48","1.10.46","1.10.45","1.10.44","1.10.43","1.10.40","1.10.37","1.10.31","1.10.29","1.10.28","1.10.26","1.10.25","1.10.24","1.10.22","1.10.21","1.10.19","1.10.18","1.10.16","1.10.14","1.10.13","1.10.12","1.10.6","1.10.5.1","1.10.5","1.9.0","1.8.9.1","1.7.10","1.7.3","1.7.2","1.7.1","1.7.0","1.6.11","1.6.9","1.6.8","1.6.7","1.6.6","1.6.5","1.6.4","1.6.3","1.6.1","1.6.0.1","1.6.0","1.5.8","1.5.7","1.5.5","1.1.7.1","1.1.7","1.1.6","1.1.5","1.1.4","1.1.3","1.1.2","1.1.1","1.1","1.0.14","1.0.12","1.0.11","1.0.10","1.0.9","1.0.8","1.0.7","1.0.6","1.0.5","1.0.4","1.0.3","1.0.2","1.0.1","1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-31159.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L"}]}