CVE-2022-31159

CVE-2022-31159 is a partial-path traversal vulnerability in the AWS S3 TransferManager component of the AWS SDK for Java v1 prior to version 1.12.261. This flaw allows a malicious actor to bypass validation logic in the downloadDirectory method by including a UNIX double-dot in an S3 object key, potentially leading to files being written outside the intended destination directory. Rated Medium severity (CVSS 6.5), the vulnerability has a low attack complexity and could result in high confidentiality impact, but no integrity or availability impact. There is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.