bug: S3Uploader loads entire file into RAM via file_get_contents #73

New Issue

2026-06-21T23:01:03Z

jmiller commented

2026-06-21 23:01:03 +00:00

Severity: CRITICAL

S3Uploader::singleUpload() uses file_get_contents($localPath) on files up to 100 MB, loading the entire backup archive into a PHP string. Combined with existing memory usage from the backup process, this reliably causes OOM on medium-to-large sites.

Fix

Use CURLOPT_UPLOAD => true with CURLOPT_INFILE and CURLOPT_INFILESIZE to stream the file to S3.

File

src/Engine/S3Uploader.php:118-131

## Severity: CRITICAL `S3Uploader::singleUpload()` uses `file_get_contents($localPath)` on files up to 100 MB, loading the entire backup archive into a PHP string. Combined with existing memory usage from the backup process, this reliably causes OOM on medium-to-large sites. ## Fix Use `CURLOPT_UPLOAD => true` with `CURLOPT_INFILE` and `CURLOPT_INFILESIZE` to stream the file to S3. ## File - `src/Engine/S3Uploader.php:118-131`

jmiller added the component: engine component: remote labels 2026-06-21 23:01:03 +00:00

jmiller referenced this issue

2026-06-21 23:04:13 +00:00

test: Deep dive audit — verify and fix all findings #81

jmiller referenced this issue from a commit

2026-06-21 23:17:16 +00:00

fix: remaining audit findings — OOM, security, error handling (#81)

jmiller referenced a pull request that will close this issue

2026-06-21 23:17:31 +00:00

fix: Remaining audit findings — OOM, security, error handling (#81) #85

jmiller closed this issue

2026-06-21 23:17:58 +00:00