All updates

Object Storage Security Update: Signed Content-Type Required

A security update to the storage layer (CVE-2026-54330) means the S3 endpoint now enforces the standard SigV4 rule that a Content-Type header, when sent, must be covered by the request signature.

Version 2.9.74SecurityStorage

What's changed

  • Requests that send an unsigned Content-Type header are rejected with AccessDenied and an empty message; downloads and listings are unaffected
  • Presigned upload URLs that sign only host break when the uploading client adds a content type, which browsers always do; sign the content type when generating the URL
  • Clients built on aws-sdk-php never sign that header; the documentation shows how to adjust each affected client, including Synology Hyper Backup
  • A temporary compatibility setting kept affected uploads working until 30 August 2026
  • Storage Share images were updated (Nextcloud 34.0.3, 33.0.8 and 32.0.14) so their own uploads keep working
Read documentation (opens in a new tab)