{"id":"EUVD-2026-29296","enisaUuid":"ac4c58a2-8215-31e8-8e92-d7f9b046d792","description":"MinIO is a high-performance object storage system. From RELEASE.2022-07-24T01-54-52Z to before RELEASE.2026-04-14T21-32-45Z, A path traversal vulnerability in MinIO\u0027s ReadMultiple internode storage-REST endpoint allows a caller holding the cluster root JWT to read files from outside the configured drive roots, bounded only by the MinIO process UID. The attacker sends POST minio/storage/{drivePath}/v63/rmpl with a msgpack-encoded body carrying ../ sequences in the Bucket field. The server opens the resulting path via os.OpenFile with O_RDONLY|O_NOATIME and returns its contents in the msgpack response stream. This vulnerability is fixed in RELEASE.2026-04-14T21-32-45Z.","datePublished":"May 11, 2026, 8:53:10 PM","dateUpdated":"May 15, 2026, 6:24:49 PM","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/minio/minio/security/advisories/GHSA-xh8f-g2qw-gcm7\n","aliases":"CVE-2026-42600\nGHSA-xh8f-g2qw-gcm7\n","assigner":"GitHub_M","epss":8.7,"enisaIdProduct":[{"id":"666f6f3c-a2b1-338c-8969-62657aa453b1","product":{"name":"minio","vendor":{"name":"minio"}},"product_version":"RELEASE.2022-07-24T01-54-52Z, \u003c RELEASE.2026-04-14T21-32-45Z"}],"enisaIdVendor":[{"id":"a7ec4b13-a4af-3b2d-8aa7-f7fb7472b827","vendor":{"name":"minio"}}],"enisaIdVulnerability":[{"id":"42c42702-818e-320a-ab91-dda4951e9c67","vulnerability":{"id":"GHSA-xh8f-g2qw-gcm7","description":"MinIO vulnerable to Path Traversal via msgpack Body in `ReadMultiple` Storage-REST Endpoint","datePublished":"May 5, 2026, 8:05:05 PM","dateUpdated":"Jun 8, 2026, 11:26:31 PM","baseScore":0.0,"references":"https://github.com/minio/minio/security/advisories/GHSA-xh8f-g2qw-gcm7\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-42600\nhttps://github.com/minio/minio\n","enisa_id":"EUVD-2026-29296\n","aliases":"CVE-2026-42600\nGHSA-xh8f-g2qw-gcm7\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:00:21 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"453d6d65-9fc0-3f5f-8187-dd4a15a1ce7d","vulnerability":{"id":"CVE-2026-42600","description":"MinIO is a high-performance object storage system. From RELEASE.2022-07-24T01-54-52Z to before RELEASE.2026-04-14T21-32-45Z, A path traversal vulnerability in MinIO\u0027s ReadMultiple internode storage-REST endpoint allows a caller holding the cluster root JWT to read files from outside the configured drive roots, bounded only by the MinIO process UID. The attacker sends POST minio/storage/{drivePath}/v63/rmpl with a msgpack-encoded body carrying ../ sequences in the Bucket field. The server opens the resulting path via os.OpenFile with O_RDONLY|O_NOATIME and returns its contents in the msgpack response stream. This vulnerability is fixed in RELEASE.2026-04-14T21-32-45Z.","datePublished":"May 11, 2026, 8:53:10 PM","dateUpdated":"May 15, 2026, 6:24:49 PM","status":"PUBLISHED","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/minio/minio/security/advisories/GHSA-xh8f-g2qw-gcm7\n","enisa_id":"EUVD-2026-29296\n","assigner":"GitHub_M","epss":8.7,"dataProcessed":"Nov 7, 2026, 7:20:46 AM","vulnerabilityProduct":[{"id":"c8ed12a2-4b45-31d9-aacd-3307a43c9bc1","product":{"name":"minio","vendor":{"name":"minio"}},"product_version":"RELEASE.2022-07-24T01-54-52Z, \u003c RELEASE.2026-04-14T21-32-45Z"}],"vulnerabilityVendor":[{"id":"bf06f245-81d9-3e09-bc91-64e3da65b2d9","vendor":{"name":"minio"}}]}}],"enisaIdAdvisory":[]}