Advisory Database
  • Advisories
  • Dependency Scanning
  1. maven
  2. ›
  3. io.minio/minio
  4. ›
  5. GHSA-h7rh-xfpj-hpcm

GHSA-h7rh-xfpj-hpcm: MinIO Java Client XML Tag Value Substitution Vulnerability

September 29, 2025

In minio-java versions prior to 8.6.0, XML tag values containing references to system properties or environment variables were automatically substituted with their actual values during processing. This unintended behavior could lead to the exposure of sensitive information, including credentials, file paths, or system configuration details, if such references were present in XML content from untrusted sources.

References

  • github.com/advisories/GHSA-h7rh-xfpj-hpcm
  • github.com/minio/minio-java
  • github.com/minio/minio-java/commit/f7a98d06b25e5464bdd4811b044e25ff9101d37f
  • github.com/minio/minio-java/releases/tag/8.6.0
  • github.com/minio/minio-java/security/advisories/GHSA-h7rh-xfpj-hpcm

Code Behaviors & Features

Detect and mitigate GHSA-h7rh-xfpj-hpcm with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions before 8.6.0

Fixed versions

  • 8.6.0

Solution

Upgrade to version 8.6.0 or above.

Weakness

  • CWE-91: XML Injection (aka Blind XPath Injection)

Source file

maven/io.minio/minio/GHSA-h7rh-xfpj-hpcm.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Sun, 05 Oct 2025 00:19:23 +0000.