{"id":"CVE-2025-31489","published":"2025-04-03T19:36:09Z","modified":"2025-04-03T20:36:19Z","title":"MinIO performs incomplete signature validation for unsigned-trailer uploads","vendor":"minio","product":"minio","tier":"tail","description":{"text":"MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. The signature component of the authorization may be invalid, which would mean that as a client you can use any arbitrary secret to upload objects given the user already has prior WRITE permissions on the bucket. Prior knowledge of access-key, and bucket name this user might have access\nto - and an access-key with a WRITE permissions is necessary. However with relevant information in place, uploading random objects to buckets is trivial and easy via curl. This issue is fixed in RELEASE.2025-04-03T14-56-28Z.","provenance":"source","from":"CVE.org"},"cvss":{"score":8.7,"severity":"HIGH","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.02519,"percentile":0.84844,"provenance":"source"},"cwes":[{"id":"CWE-347","name":"Improper Verification of Cryptographic Signature"}],"references":[{"url":"https://github.com/minio/minio/security/advisories/GHSA-wg47-6jq2-q2hh","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/minio/minio/pull/21103","tags":["x_refsource_MISC"]}],"priority":{"score":28.1,"factors":[{"name":"EPSS percentile","points":16.97},{"name":"Public exploit code","points":5.0},{"name":"CVSS severity","points":6.09}]},"exploitSources":{"nuclei":[{"id":"CVE-2025-31489","name":"MinIO - Incomplete Signature Validation for Unsigned-Trailer Uploads","severity":"high","path":"http/cves/2025/CVE-2025-31489.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-31489.yaml"}],"provenance":"source"},"vendorSlug":"minio","affectedVersions":[{"vendor":"minio","product":"minio","versions":["< RELEASE.2025-04-03T14-56-28Z"]}],"affected":[{"ecosystem":"Go","package":"github.com/minio/minio","vulnerableRanges":["<0.0.0-20250403145552-8c70975283f9"],"patched":["0.0.0-20250403145552-8c70975283f9"],"from":["GHSA-wg47-6jq2-q2hh","GO-2025-3594"],"provenance":"source"}],"euvd":{"id":"EUVD-2025-9731","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2024-36107","published":"2024-05-28","fixed":"0.0.0-20240527191746-e0fe7cc39172","kev":false},{"cve":"CVE-2024-55949","published":"2024-12-16","fixed":"0.0.0-20241213221912-68b004a48f41","kev":false},{"cve":"CVE-2025-27414","published":"2025-02-28","fixed":"0.0.0-20250227184332-4c71f1b4ec0f","kev":false,"link":{"from":"CVE-2025-27414","to":"CVE-2025-31489","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/minio/minio","fromFixed":"0.0.0-20250227184332-4c71f1b4ec0f","toFixed":"0.0.0-20250403145552-8c70975283f9","daysApart":34}]}},{"cve":"CVE-2025-31489","published":"2025-04-03","fixed":"0.0.0-20250403145552-8c70975283f9","kev":false},{"cve":"CVE-2025-62506","published":"2025-10-16","fixed":"0.0.0-20251015170045-c1a49490c78e","kev":false,"link":{"from":"CVE-2025-31489","to":"CVE-2025-62506","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/minio/minio","fromFixed":"0.0.0-20250403145552-8c70975283f9","toFixed":"0.0.0-20251015170045-c1a49490c78e","daysApart":196}]}},{"cve":"CVE-2026-42600","published":"2026-05-11","fixed":"0.0.0-20260414213245","kev":false}],"package":"Go:github.com/minio/minio"}}