> CVE-2025-59952

« BACK_TO_HOME
PUBLISHED
2025-09-30 04:43
MODIFIED
2025-10-02 19:12
EPSS (Prob. Exploit)
0.49%
Top 57.5%
DATA SOURCES:
NVD 🔗 2025-10-18 RED HAT 🔗 2025-10-18 CVE PROJECT 🔗 2026-01-19 FIRST EPSS 🔗 2026-11-08 GITHUB 🔗 2026-10-28 OSV 🔗 2026-11-08

> DESCRIPTION

MinIO Java SDK is a Simple Storage Service (aka S3) client to perform bucket and object operations to any Amazon S3 compatible object storage service. In minio-java versions prior to 8.6.0, XML tag values containing references to system properties or environment variables were automatically substituted with their actual values during processing. This unintended behavior could lead to the exposure of sensitive information, including credentials, file paths, or system configuration details, if such references were present in XML content from untrusted sources. This is fixed in version 8.6.0.

> AFFECTED_PRODUCTS

Red Hat - Red Hat build of Apache Camel 4.10.7 for Spring Boot 3.4.10

> RED HAT SECURITY ADVISORIES

Red Hat Security Advisory: Red Hat Build of Apache Camel 4.10.7 for Spring Boot release.
Red Hat build of Apache Camel 4.10.7 for Spring Boot patch release and security update is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Com...
Red Hat Security Advisory: Red Hat Build of Apache Camel 4.14 for Quarkus 3.27 update is now available (RHBQ 3.27.0.GA)
An update for Red Hat Build of Apache Camel 4.14 for Quarkus 3.27 update is now available (RHBQ 3.27.0.GA). The purpose of this text-only errata is to inform you about the enhancements that improve yo...

> RED HAT SEVERITY ASSESSMENT

THREAT SEVERITY
Important

> GITHUB SECURITY ADVISORY

GHSA-h7rh-xfpj-hpcm HIGH

MinIO Java Client XML Tag Value Substitution Vulnerability

AFFECTED PACKAGES:
MAVEN / io.minio:minio
< 8.6.0
Fixed in: 8.6.0

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

minio-java Client XML Tag is Vulnerable to Value Substitution

AFFECTED PACKAGES:
Unknown / Unknown
96 versions affected
ALIASES:
GHSA-h7rh-xfpj-hpcm

> HISTORIQUE DES MODIFICATIONS

Première apparition
30/09/2025 04:43
Source: NVD
📊 ENRICHISSEMENT 18/10/2025 15:08
CVEPROJECT
Champ modifié: CVE Project
Ancienne valeur:
Non
Nouvelle valeur:
Oui
📊 ENRICHISSEMENT 18/10/2025 12:05
REDHAT
Champ modifié: Sévérité Red Hat
Ancienne valeur:
N/A
Nouvelle valeur:
{ "threat_severity": "Important", "severity_scale": null }
📊 ENRICHISSEMENT 18/10/2025 12:05
REDHAT
Champ modifié: Red Hat
Ancienne valeur:
Non
Nouvelle valeur:
Oui
Total des modifications: 3 Dernière mise à jour: 1 year ago
« BACK_TO_HOME