CVE-2025-59952: MinIO Java Client XML Tag Value Substitution Vulnerability

September 29, 2025 (updated September 30, 2025)

In minio-java versions prior to 8.6.0, XML tag values containing references to system properties or environment variables were automatically substituted with their actual values during processing. This unintended behavior could lead to the exposure of sensitive information, including credentials, file paths, or system configuration details, if such references were present in XML content from untrusted sources.

References

github.com/advisories/GHSA-h7rh-xfpj-hpcm
github.com/minio/minio-java
github.com/minio/minio-java/commit/f7a98d06b25e5464bdd4811b044e25ff9101d37f
github.com/minio/minio-java/releases/tag/8.6.0
github.com/minio/minio-java/security/advisories/GHSA-h7rh-xfpj-hpcm
nvd.nist.gov/vuln/detail/CVE-2025-59952

Code Behaviors & Features

Detect and mitigate CVE-2025-59952 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →