PT-2025-39921 · Minio · Minio Java Sdk

Pyguerder + 1 · Publicado 2025-09-29 · Atualizado 2025-09-30 · CVE-2025-59952

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions MinIO Java SDK versions prior to 8.6.0

Description The MinIO Java SDK is a client for performing bucket and object operations with Amazon S3 compatible object storage services. Versions prior to 8.6.0 improperly handle XML tag values containing references to system properties or environment variables, automatically substituting them with their actual values. This can expose sensitive information like credentials, file paths, or system configuration details if the XML content originates from an untrusted source.

Recommendations Update to MinIO Java SDK version 8.6.0 or later.

Exploit

Correção

Code Injection

RCE

Enumeração de Fraquezas

CWE-94

CWE-20

CWE-91

Identificadores relacionados

CVE-2025-59952

GHSA-H7RH-XFPJ-HPCM

Produtos afetados

Minio Java Sdk

Referências · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59952.json · Exploit
• https://github.com/minio/minio-java/commit/f7a98d06b25e5464bdd4811b044e25ff9101d37f · Nota
• https://github.com/minio/minio-java · Nota
• https://github.com/minio/minio-java/security/advisories/GHSA-h7rh-xfpj-hpcm · Nota
• https://github.com/minio/minio-java/releases/tag/8.6.0 · Nota
• https://twitter.com/VulmonFeeds/status/1972900160536490166 · Publicação no Twitter
• https://t.me/cveNotify/136900 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-h7rh-xfpj-hpcm · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1972811259125919995 · Publicação no Twitter
• https://t.me/CVEtracker/33683 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2025-59952 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2025-59952 · Aviso do Fabricante