PT-2025-39921

CVE-2025-59952

Publicado

2025-09-29

Atualizado

2026-10-09

Descrição por

CVSS 4.0

8.7

Alta

MétricasAV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions MinIO Java SDK versions prior to 8.6.0

Description The MinIO Java SDK is a client for performing bucket and object operations with Amazon S3 compatible object storage services. Versions prior to 8.6.0 improperly handle XML tag values containing references to system properties or environment variables, automatically substituting them with their actual values. This can expose sensitive information like credentials, file paths, or system configuration details if the XML content originates from an untrusted source.

Recommendations Update to MinIO Java SDK version 8.6.0 or later.

Explorabilidade

Exploit

Correção

Impactos

Pesquisadores

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-91: XML Injection (aka Blind XPath Injection)

CWE-20: Improper Input Validation

CWE-94: Improper Control of Generation of Code (\'Code Injection\')