What’s Vulnerable › Vulnerabilities

CVE-2022-35919: Authenticated requests for server update admin API allows path traversal in minio

• Severity: low (CVSS 2.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 52.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-08-01 · updated 2026-06-17
• Weakness: CWE-22

Description

MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. In affected versions all 'admin' users authorized for `admin:ServerUpdate` can selectively trigger an error that in response, returns the content of the path requested. Any normal OS system would allow access to contents at any arbitrary paths that are readable by MinIO process. Users are advised to upgrade. Users unable to upgrade may disable ServerUpdate API by denying the `admin:ServerUpdate` action for your admin users via IAM policies.

Affected products

• minio: before 2022-07-29t19-40-48z — fixed in 2022-07-29t19-40-48z

How to fix

Upgrade to a fixed version: minio 2022-07-29t19-40-48z. Check the vendor advisory for mitigations.

References

• http://packetstormsecurity.com/files/175010/Minio-2022-07-29T19-40-48Z-Path-Traversal.html
• https://github.com/minio/minio/commit/bc72e4226e669d98c8e0f3eccc9297be9251c692
• https://github.com/minio/minio/pull/15429
• https://github.com/minio/minio/security/advisories/GHSA-gr9v-6pcm-rqvg
• http://packetstormsecurity.com/files/175010/Minio-2022-07-29T19-40-48Z-Path-Traversal.html
• https://github.com/minio/minio/commit/bc72e4226e669d98c8e0f3eccc9297be9251c692
• https://github.com/minio/minio/pull/15429
• https://github.com/minio/minio/security/advisories/GHSA-gr9v-6pcm-rqvg

Get alerted when CVE-2022-35919 or the next vulnerability affects your stack