SB2026012015 - Spoofing attack in Amazon AWS SDK extension for TYPO3
Published: January 20, 2026
Security Bulletin ID
SB2026012015
Severity
Low
Patch available
NO
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Spoofing attack (CVE-ID: CVE-2025-14761)
The vulnerability allows a remote attacker to perform spoofing attack.
The vulnerability exists due to a single ciphertext can be decrypted into 2 different plaintexts by using different encryption keys. A remote user with permission to upload a new instruction file to the S3 bucket to replace the existing instruction file can create a rouge EDK key and force the application to use it in any future attempts to decrypt the underlying encrypted message with the S3EC.
Remediation
Cybersecurity Help is not aware of any official remediation provided by the vendor.