{"id":"EUVD-2025-9731","revision":"d6cc3b590cd84947831c1b8feb7b8b14","records":[{"revision":"d6cc3b590cd84947831c1b8feb7b8b14","observedAt":"2026-11-11T02:49:21.795+00:00","statement":{"source":"euvd","id":"EUVD-2025-9731","aliases":["CVE-2025-31489","GHSA-wg47-6jq2-q2hh"],"title":"MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. The signature component of the authorization may be invalid, which would mean that as a client you can use any arbitrary secret to upload obje…","description":"MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. The signature component of the authorization may be invalid, which would mean that as a client you can use any arbitrary secret to upload objects given the user already has prior WRITE permissions on the bucket. Prior knowledge of access-key, and bucket name this user might have access\nto - and an access-key with a WRITE permissions is necessary. However with relevant information in place, uploading random objects to buckets is trivial and easy via curl. This issue is fixed in RELEASE.2025-04-03T14-56-28Z.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","score":8.7,"severity":null}],"references":["https://github.com/minio/minio/security/advisories/GHSA-wg47-6jq2-q2hh","https://github.com/minio/minio/pull/21103"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-9731","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Apr 3, 2025, 7:36:09 PM","dateUpdated":"Apr 3, 2025, 8:36:19 PM"},"relatedAdvisories":[{"id":"openSUSE-SU-2025:14982-1","title":"govulncheck-vulndb-0.0.20250409T170536-1.1 on GA media","vulnerabilityIds":["CVE-2025-31483","CVE-2025-31489","CVE-2025-32024","CVE-2025-32025"]},{"id":"WID-SEC-W-2025-0714","title":"MinIO: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen","vulnerabilityIds":["CVE-2025-31489"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2025-9731","identifiers":["EUVD-2025-9731","CVE-2025-31489","GHSA-wg47-6jq2-q2hh"]},"retained":false,"historicalAffected":[]}],"coverage":[]}