GCVE-110-CLOUD-2025-0021

Advisory Published

Vulnetix · Advisory published February 19, 2025

AWS solution 'Dynamic Image Transformation for Amazon CloudFront', prior to version 6.2.6, contains a configuration weakness. The Lambda role doesn't constrain bucket access, and the environment variable can be set to a wildcard, allowing access to any bucket. This could potentially lead to unintended access to sensitive images across multiple buckets in the AWS account.

Download JSON Open in Console

Affected Products

Vendor	Product	Versions	Platforms
AWS	Cloud Services	—	—
AWS	Dynamic Image Transformation for Amazon CloudFront, AWS Serverless Image Handler	—	—

References

Abusing AWS Serverless Image Handler Configuration Weakness

advisory

Browse GCVE Records

74,267 records in the GCVE database · Updated July 22, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON