Path Traversal in Minio

CVE-2026-42600

MinIO is a high-performance object storage system. From RELEASE.2022-07-24T01-54-52Z to before RELEASE.2026-04-14T21-32-45Z, A path traversal vulnerability in MinIO's ReadMultiple internode storage-REST endpoint allows a caller holding the cluster root JWT to read files from outside the configured drive roots, bounded only by the MinIO process UID. The attacker sends POST minio/storage/{drivePath}/v63/rmpl with a msgpack-encoded body carrying ../ sequences in the Bucket field. The server opens the resulting path via os.OpenFile with O_RDONLY|O_NOATIME and returns its contents in the msgpack response stream. This vulnerability is fixed in RELEASE.2026-04-14T21-32-45Z.

Vulnerability class: Path Traversal (Directory Traversal)

Published · last modified .

CVSS v3 metric

CVSS v3 base score 4.9 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N.

EPSS exploit prediction

EPSS: 0.005 (38.6th percentile), scored .

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 39th percentile — 38.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2026-42600: fell from 0.095 to 0.005.

EPSS over last 30 days · oldest: 0.095 · newest: 0.005 · change: -0.090

Affected products

  • Minio — versions >= RELEASE.2022-07-24T01-54-52Z, < RELEASE.2026-04-14T21-32-45Z

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2026-42600?
CVE-2026-42600 is a medium-severity vulnerability in Minio, classified under Path Traversal. CVSS score: 4.9/10. Published 2026-05-11.
How severe is CVE-2026-42600?
Medium severity. CVSS v3 base score is 4.9 out of 10.