Preliminary research

Path traversal in signed URLs — present even in the official AWS SDKs

Matsui and Eui Chul Chung · GMO Flatt Security Blog · 10 March 2026

AI-collected research leads through 6 October 2026, including bounded month-by-month reviews of selected social and community sources from January through September. Unranked, incomplete, not community-vetted, and subject to change.

S3 keys are flat, so ../ in an object key is only text until something normalises the path while a presigned URL is built. AWS SDK for Go v1 runs path.Clean() after filling /{Bucket}/{Key+}, so a key of ../other-bucket/secret.txt signs a URL for a different bucket, while @aws-sdk/cloudfront-signer normalised through new URL(). The same trap reaches application code through path.normalize, path.join and URL construction before signing.

Record

Researcher

Matsui and Eui Chul Chung

Published by

GMO Flatt Security Blog

Date

10 March 2026

In the archive

• Collected in the 2026 preliminary research sweep

Tags

• path-traversal
• aws
• url-parsing
• parser-differential
• go
• nodejs
• cdn
• owasp-a01-2021

This page is the archive's own catalogue record. The research is the work of Matsui and Eui Chul Chung, first published at the original source. Preserved copies are kept so the citation survives its host.