PT-2025-39921 · Minio · Minio Java Sdk

Pyguerder + 1 · Published 2025-09-29 · Updated 2025-09-30 · CVE-2025-59952

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions MinIO Java SDK versions prior to 8.6.0

Description The MinIO Java SDK is a client for performing bucket and object operations with Amazon S3 compatible object storage services. Versions prior to 8.6.0 improperly handle XML tag values containing references to system properties or environment variables, automatically substituting them with their actual values. This can expose sensitive information like credentials, file paths, or system configuration details if the XML content originates from an untrusted source.

Recommendations Update to MinIO Java SDK version 8.6.0 or later.

Exploit

Fix

Code Injection

RCE

Weakness Enumeration

CWE-94

CWE-20

CWE-91

Related Identifiers

CVE-2025-59952

GHSA-H7RH-XFPJ-HPCM

Affected Products

Minio Java Sdk

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59952.json · Exploit
• https://osv.dev/vulnerability/GHSA-h7rh-xfpj-hpcm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59952 · Security Note
• https://osv.dev/vulnerability/CVE-2025-59952 · Vendor Advisory
• https://github.com/minio/minio-java/commit/f7a98d06b25e5464bdd4811b044e25ff9101d37f · Note
• https://github.com/minio/minio-java · Note
• https://github.com/minio/minio-java/security/advisories/GHSA-h7rh-xfpj-hpcm · Note
• https://github.com/minio/minio-java/releases/tag/8.6.0 · Note
• https://twitter.com/VulmonFeeds/status/1972900160536490166 · Twitter Post
• https://t.me/cveNotify/136900 · Telegram Post
• https://twitter.com/CVEnew/status/1972811259125919995 · Twitter Post
• https://t.me/CVEtracker/33683 · Telegram Post