Path Traversal in MinIO Object Storage

Publication date: 2026-05-11

Last updated on: 2026-05-26

Assigner: GitHub, Inc.

Description

MinIO is a high-performance object storage system. From RELEASE.2022-07-24T01-54-52Z to before RELEASE.2026-04-14T21-32-45Z, A path traversal vulnerability in MinIO's ReadMultiple internode storage-REST endpoint allows a caller holding the cluster root JWT to read files from outside the configured drive roots, bounded only by the MinIO process UID. The attacker sends POST minio/storage/{drivePath}/v63/rmpl with a msgpack-encoded body carrying ../ sequences in the Bucket field. The server opens the resulting path via os.OpenFile with O_RDONLY|O_NOATIME and returns its contents in the msgpack response stream. This vulnerability is fixed in RELEASE.2026-04-14T21-32-45Z.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-11

Last Modified

2026-05-26

Generated

2026-07-11

AI Q&A

2026-05-12

EPSS Evaluated

2026-07-10

NVD

CVE-2026-42600

Affected Vendors & Products

Vendor	Product	Version / Range
minio	minio	From 2022-07-24t01-54-52z (inc) to 2026-04-14t21-32-45z (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Mitigation Strategies

The vulnerability is fixed in MinIO RELEASE.2026-04-14T21-32-45Z. To mitigate this vulnerability, you should upgrade your MinIO installation to this release or a later version.

Executive Summary

This vulnerability is a path traversal issue in MinIO's ReadMultiple internode storage-REST endpoint. It allows an attacker who has the cluster root JWT to read files outside the configured drive roots by sending a specially crafted POST request with path traversal sequences (../) in the Bucket field. The server then opens and returns the contents of these files, potentially exposing sensitive data.

Impact Analysis

If exploited, this vulnerability can allow an attacker with cluster root JWT access to read arbitrary files on the MinIO server outside of the intended storage areas. This could lead to unauthorized disclosure of sensitive information, data leakage, and compromise of system confidentiality.

Hi! I’m here to help you understand CVE-2026-42600. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70