CVE-2026-42600
Analyzed Analyzed - Analysis Complete
Path Traversal in MinIO Object Storage

Publication date: 2026-05-11

Last updated on: 2026-05-26

Assigner: GitHub, Inc.

Description
MinIO is a high-performance object storage system. From RELEASE.2022-07-24T01-54-52Z to before RELEASE.2026-04-14T21-32-45Z, A path traversal vulnerability in MinIO's ReadMultiple internode storage-REST endpoint allows a caller holding the cluster root JWT to read files from outside the configured drive roots, bounded only by the MinIO process UID. The attacker sends POST minio/storage/{drivePath}/v63/rmpl with a msgpack-encoded body carrying ../ sequences in the Bucket field. The server opens the resulting path via os.OpenFile with O_RDONLY|O_NOATIME and returns its contents in the msgpack response stream. This vulnerability is fixed in RELEASE.2026-04-14T21-32-45Z.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-11
Last Modified
2026-05-26
Generated
2026-06-21
AI Q&A
2026-05-12
EPSS Evaluated
2026-06-20
NVD
CVE-2026-42600
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
minio minio From 2022-07-24t01-54-52z (inc) to 2026-04-14t21-32-45z (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is a path traversal issue in MinIO's ReadMultiple internode storage-REST endpoint. It allows an attacker who has the cluster root JWT to read files outside the configured drive roots by sending a specially crafted POST request with path traversal sequences (../) in the Bucket field. The server then opens and returns the contents of these files, potentially exposing sensitive data.

Mitigation Strategies

The vulnerability is fixed in MinIO RELEASE.2026-04-14T21-32-45Z. To mitigate this vulnerability, you should upgrade your MinIO installation to this release or a later version.

Impact Analysis

If exploited, this vulnerability can allow an attacker with cluster root JWT access to read arbitrary files on the MinIO server outside of the intended storage areas. This could lead to unauthorized disclosure of sensitive information, data leakage, and compromise of system confidentiality.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-42600. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart