Vulnerability · Published Sep 29, 2025 · Assigned by GitHub_M
CVE-2025-59952minio-java Client XML Tag is Vulnerable to Value Substitution
High 8.7
In plain English
A high-severity improper input validation in minio-java from minio. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
MinIO Java SDK is a Simple Storage Service (aka S3) client to perform bucket and object operations to any Amazon S3 compatible object storage service. In minio-java versions prior to 8.6.0, XML tag values containing references to system properties or environment variables were automatically substituted with their actual values during processing. This unintended behavior could lead to the exposure of sensitive information, including credentials, file paths, or system configuration details, if such references were present in XML content from untrusted sources. This is fixed in version 8.6.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | io.minio:minio | 8.6.0 | GHSA-h7rh-xfpj-hpcm |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| minio | minio-java | < 8.6.0 |
Weakness: CWE-20, CWE-94 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
References
- https://github.com/minio/minio-java/security/advisories/GHSA-h7rh-xfpj-hpcm x_refsource_CONFIRM
- https://github.com/minio/minio-java/commit/f7a98d06b25e5464bdd4811b044e25ff9101d37f x_refsource_MISC
- https://github.com/minio/minio-java/releases/tag/8.6.0 x_refsource_MISC