aws/aws-sdk-php security advisory

CVE-2025-14761: Key Commitment Issues in S3 Encryption Clients in aws/aws-sdk-php

CVE-2025-14761 is a medium-severity security vulnerability in the PHP package aws/aws-sdk-php (CVSS 5.3), published 17 December 2025. It is fixed in 3.368.0; earlier versions are affected. Exploiting it needs a low-privilege user account.

medium 5.3 published 2025-12-17 · updated 2026-06-17

Affected versions: >= 3.0.0, < 3.368.0
Fixed in: 3.368.0
Newest release: 3.402.5
Severity: Medium · CVSS 5.3
Type: Security issue
CWE-327
Exploited in the wild: Not on the CISA KEV list
checked 2026-11-04

Is your aws/aws-sdk-php version affected?

Run composer show aws/aws-sdk-php in your project, then enter the version. We check it against this and every other known aws/aws-sdk-php advisory.

Who can exploit CVE-2025-14761

Access: A normal, low-privilege user account in the app.
Conditions: It only works under specific conditions the attacker does not fully control (CVSS rates the attack as high complexity).

CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N

Your app is only exposed if it uses the affected part of aws/aws-sdk-php. The advisory below says which part that is. If you are not sure, upgrade anyway: it costs less than finding out.

How to fix CVE-2025-14761 in aws/aws-sdk-php

Find the installed version: composer show aws/aws-sdk-php. If you never required it yourself, composer why aws/aws-sdk-php shows which package pulls it in.
Update it: composer update aws/aws-sdk-php --with-all-dependencies. You need 3.368.0 or newer.
If Composer will not go that high, your composer.json constraint is holding it back. Widen it (for example "aws/aws-sdk-php": "^3.368.0" if you can take that version), or upgrade the package that requires it.
Run composer audit. It reads the same advisory data and should no longer list CVE-2025-14761.
Commit composer.lock and deploy it. On the server, run composer install --no-dev from the lock file, not composer update.

If you cannot upgrade yet

The advisory gives this workaround:

To mitigate this issue, upgrade AWS SDK for PHP to version 3.368.0 or later

General hardening for this kind of issue while the upgrade waits. None of it replaces the fix.

If your app does not use the affected feature, note that in your audit, but still plan the upgrade.

The CVE-2025-14761 advisory

Missing cryptographic key commitment in the AWS SDK for PHP may allow a user with write access to the S3 bucket to introduce a new EDK that decrypts to different plaintext when the encrypted data key is stored in an "instruction file" instead of S3's metadata record. To mitigate this issue, upgrade AWS SDK for PHP to version 3.368.0 or later

Description from the CVE record, via the NVD entry for CVE-2025-14761. Advisory title: “Key Commitment Issues in S3 Encryption Clients”.

References

GitHub security advisory GHSA-x8cp-jf6f-r4xh github.com
Aws security advisory aws.amazon.com
Release 3.368.0 github.com

Other aws/aws-sdk-php advisories

high AWS SDK for PHP has CloudFront Policy Document Injection via Special Characters 2026-03-27
medium CVE-2023-51651: Potential URI resolution path traversal in the AWS SDK for PHP 2023-11-22
high CVE-2015-5723: Security Misconfiguration Vulnerability in the AWS SDK for PHP 2015-07-24

Need help patching or upgrading? Laskyr does PHP and Laravel security fixes and upgrades. Tell us what you run and we reply with a plan and a price.

Ask about a fix

Where this data comes from

Affected and fixed versions: the Packagist security advisories API (GitHub Advisory Database and FriendsOfPHP), the same data composer audit uses. Synced 2026-11-03.
Description, score, weakness and references: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
Exploited-in-the-wild status: the CISA Known Exploited Vulnerabilities catalog, checked 2026-11-04.
Compiled by Daniel Lasek at Laskyr from the sources above. The summary, “who can exploit it”, “how to fix it” and hardening sections are our plain-English reading of the record and are generated from it. The quoted description is the record's own text. Spot an error? Tell us.