PkgSeer

Vulnerability GO-2026-5757

Unknown

3 months ago

MinIO vulnerable to Path Traversal via msgpack Body in `ReadMultiple` Storage-REST Endpoint in github.com/minio/minio

>=0.0.0

Summary

MinIO vulnerable to Path Traversal via msgpack Body in `ReadMultiple` Storage-REST Endpoint in github.com/minio/minio

Details

MinIO vulnerable to Path Traversal via msgpack Body in ReadMultiple Storage-REST Endpoint in github.com/minio/minio.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/minio/minio from v0.0.0-20220724015452 before v0.0.0-20260414213245.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

MinIO affected a DoS via Unbounded Memory Allocation in S3 Select CSV Parsing in github.com/minio/minio

v0.0.0-20260212201848-7aac2a2c5b7c GO-2026-5415

MinIO has an Unauthenticated Object Write via Query-String Credential Signature Bypass in Unsigned-Trailer Uploads in github.com/minio/minio

v0.0.0-20260212201848-7aac2a2c5b7c GO-2026-5437

MinIO has an Unauthenticated Object Write via Missing Signature Verification in Unsigned-Trailer Uploads in github.com/minio/minio

v0.0.0-20260212201848-7aac2a2c5b7c GO-2026-5284

MinIO vulnerable to Path Traversal via msgpack Body in `ReadMultiple` Storage-REST Endpoint

>=0.0.0-20220724015452 <0.0.0-20260414213245 GHSA-xh8f-g2qw-gcm7

MinIO has an Unauthenticated Object Write via Query-String Credential Signature Bypass in Unsigned-Trailer Uploads

v0.0.0-20260212201848-7aac2a2c5b7c GHSA-hv4r-mvr4-25vw

View all vulnerabilities for these packages

Impacted packages

github.com/minio/minio

Timeline

Published

3 months ago

Last Modified

2 hours ago