CVE-2025-31489
Description
MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. The signature component of the authorization may be invalid, which would mean that as a client you can use any arbitrary secret to upload objects given the user already has prior WRITE permissions on the bucket. Prior knowledge of access-key, and bucket name this user might have access to - and an access-key with a WRITE permissions is necessary. However with relevant information in place, uploading random objects to buckets is trivial and easy via curl. This issue is fixed in RELEASE.2025-04-03T14-56-28Z.
How to fix
- github.com/minio/minio0.0.0-20250403145552-8c70975283f9 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| github.com/minio/minioGo | v < 0.0.0-20250403145552-8c70975283f9 | 0.0.0-20250403145552-8c70975283f9 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.