{"id":"CVE-2026-42600","aliases":["GHSA-xh8f-g2qw-gcm7","GO-2026-5757"],"url":"https://o3.security/vulnerability/CVE-2026-42600","summary":"MinIO: Path Traversal via msgpack Body in `ReadMultiple` Storage-REST Endpoint","details":"MinIO is a high-performance object storage system. From 2022.07.24 to before 2026.04.14, A path traversal vulnerability in MinIO's ReadMultiple internode storage-REST endpoint allows a caller holding the cluster root JWT to read files from outside the configured drive roots, bounded only by the MinIO process UID. The attacker sends POST minio/storage/{drivePath}/v63/rmpl with a msgpack-encoded body carrying ../ sequences in the Bucket field. The server opens the resulting path via os.OpenFile with O_RDONLY|O_NOATIME and returns its contents in the msgpack response stream. This vulnerability is fixed in 2026.04.14.","published":"2026-05-13T15:13:37.429Z","modified":"2026-09-08T08:48:13.541473494Z","cvss":null,"epss":{"score":0.09491,"percentile":0.95189,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Bitnami","name":"minio","fixedVersion":null}],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/minio/minio/security/advisories/GHSA-xh8f-g2qw-gcm7"},{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42600"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-08T08:48:13.541473494Z"}}