PT-2025-39921

CVE-2025-59952

Published

2025-09-29

Updated

2026-10-09

Description by

CVSS 4.0

8.7

High

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions MinIO Java SDK versions prior to 8.6.0

Description The MinIO Java SDK is a client for performing bucket and object operations with Amazon S3 compatible object storage services. Versions prior to 8.6.0 improperly handle XML tag values containing references to system properties or environment variables, automatically substituting them with their actual values. This can expose sensitive information like credentials, file paths, or system configuration details if the XML content originates from an untrusted source.

Recommendations Update to MinIO Java SDK version 8.6.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-91: XML Injection (aka Blind XPath Injection)

CWE-20: Improper Input Validation

CWE-94: Improper Control of Generation of Code (\'Code Injection\')