Files or Directories Accessible to External Parties Affecting github.com/minio/minio/cmd package, versions <RELEASE.2025-06-13T11-33-47Z
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-GOLANG-GITHUBCOMMINIOMINIOCMD-10494014
- published12 Nov 2025
- disclosed11 Jun 2025
- creditkeryfan
Introduced: 11 Jun 2025
CVE NOT AVAILABLE CWE-552 Â (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade github.com/minio/minio/cmd to version RELEASE.2025-06-13T11-33-47Z or higher.
Overview
github.com/minio/minio/cmd is an open source object storage server compatible with Amazon S3 APIs.
Affected versions of this package are vulnerable to Files or Directories Accessible to External Parties via the function ListMultipartUploads in the file erasure-server-pool.go. An attacker with low privileges can view metadata for all multipart uploads on the server, gaining unauthorized information about other users' files.