CVE-2026-42600
Received Received - Intake
Path Traversal in MinIO Object Storage

Publication date: 2026-05-11

Last updated on: 2026-05-11

Assigner: GitHub, Inc.

Description
MinIO is a high-performance object storage system. From RELEASE.2022-07-24T01-54-52Z to before RELEASE.2026-04-14T21-32-45Z, A path traversal vulnerability in MinIO's ReadMultiple internode storage-REST endpoint allows a caller holding the cluster root JWT to read files from outside the configured drive roots, bounded only by the MinIO process UID. The attacker sends POST minio/storage/{drivePath}/v63/rmpl with a msgpack-encoded body carrying ../ sequences in the Bucket field. The server opens the resulting path via os.OpenFile with O_RDONLY|O_NOATIME and returns its contents in the msgpack response stream. This vulnerability is fixed in RELEASE.2026-04-14T21-32-45Z.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-11
Last Modified
2026-05-11
Generated
2026-05-12
AI Q&A
2026-05-12
EPSS Evaluated
N/A
NVD
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
minio minio From 2022-07-24T01-54-52Z (inc) to 2026-04-14T21-32-45Z (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?

The vulnerability is fixed in MinIO RELEASE.2026-04-14T21-32-45Z. To mitigate this vulnerability, you should upgrade your MinIO installation to this release or a later version.


Can you explain this vulnerability to me?

This vulnerability is a path traversal issue in MinIO's ReadMultiple internode storage-REST endpoint. It allows an attacker who has the cluster root JWT to read files outside the configured drive roots by sending a specially crafted POST request with path traversal sequences (../) in the Bucket field. The server then opens and returns the contents of these files, potentially exposing sensitive data.


How can this vulnerability impact me? :

If exploited, this vulnerability can allow an attacker with cluster root JWT access to read arbitrary files on the MinIO server outside of the intended storage areas. This could lead to unauthorized disclosure of sensitive information, data leakage, and compromise of system confidentiality.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart