CVE-2025-24961: S3Proxy Path Traversal in Filesystem Storage Backends

S3Proxy exposes an S3-compatible API in front of other storage. Its filesystem and filesystem-nio2 backends map object keys onto local file paths in the bundled Apache jclouds filesystem provider, and that mapping did not stop traversal sequences.

An authenticated client requests an object key that walks out of the configured storage directory and reads local files from the host. S3Proxy 2.6.0 ships the two jclouds commits that close the hole. No workaround exists short of upgrading.