Amazon S3 for Craft CMS has an Information Disclosure vulnerability
GHSA-hwj7-4vgc-j3v9 · CVE-2026-32265
Affected
Fixed in
Published
16 Mar 2026
See everything
Needs attention Every finding from every site in one list, worst first. Checks Uptime and API checks as often as every minute, SSL and domains, plus versions and health from the connector. Setup Import your sites from your host. Porro opens the connector pull request.Act on it
Updates Care plans set when updates are due. Porro opens the pull request. Alerts Down and critical go straight to Slack and email. The rest waits for the morning round.Free trial
28 days free
No card needed
Four plans priced by sites, from 10 sites to 300 and more. For agencies and freelancers looking after client sites on care plans.
PHP
Laravel Scheduler, queues, failed jobs, migrations, health and backups. Filament Filament, Livewire and plugin versions, on top of Laravel. Statamic Statamic and addon versions and advisories. Craft CMS Craft and plugin versions, devMode, queue and project config.JavaScript and more
JavaScript Node, framework and lock-file packages, on every production build. One-click install Porro opens the pull request and sets the key. Forge · Ploi · Laravel CloudOpen source
Read-only · signed
Read exactly what leaves a site
Every connector is a small public package that only sends.
composer require porro/laravel-connector
Advisories / composer / craftcms
Security advisories for craftcms/aws-s3, newest first. 1 known, 1 without a fix yet.
Latest version
2.3.2
Advisories
1 · 1 unfixed
Last advisory
16 Mar 2026
Safe from
no fix for all yet
1 advisory · newest first
GHSA-hwj7-4vgc-j3v9 · CVE-2026-32265
Affected
Fixed in
Published
16 Mar 2026
From Packagist and the GitHub advisory database · synced hourly
Porro reads composer.lock and package-lock from every site on your care plans and puts the ones that need you at the top. Updates arrive as pull requests.