{"id":"CVE-2025-31489","published":"2025-04-03T19:36:09Z","modified":"2025-04-03T20:36:19Z","title":"MinIO performs incomplete signature validation for unsigned-trailer uploads","vendor":"minio","product":"minio","tier":"tail","description":{"text":"MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. The signature component of the authorization may be invalid, which would mean that as a client you can use any arbitrary secret to upload objects given the user already has prior WRITE permissions on the bucket. Prior knowledge of access-key, and bucket name this user might have access\nto - and an access-key with a WRITE permissions is necessary. However with relevant information in place, uploading random objects to buckets is trivial and easy via curl. This issue is fixed in RELEASE.2025-04-03T14-56-28Z.","provenance":"source","from":"CVE.org"},"cvss":{"score":8.7,"severity":"HIGH","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.02519,"percentile":0.84823,"provenance":"source"},"cwes":[{"id":"CWE-347","name":"Improper Verification of Cryptographic Signature"}],"references":[{"url":"https://github.com/minio/minio/security/advisories/GHSA-wg47-6jq2-q2hh","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/minio/minio/pull/21103","tags":["x_refsource_MISC"]}],"priority":{"score":28.1,"factors":[{"name":"EPSS percentile","points":16.96},{"name":"Public exploit code","points":5.0},{"name":"CVSS severity","points":6.09}]},"exploitSources":{"nuclei":[{"id":"CVE-2025-31489","name":"MinIO - Incomplete Signature Validation for Unsigned-Trailer Uploads","severity":"high","path":"http/cves/2025/CVE-2025-31489.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-31489.yaml"}],"provenance":"source"},"vendorSlug":"minio","affectedVersions":[{"vendor":"minio","product":"minio","versions":["< RELEASE.2025-04-03T14-56-28Z"]}],"affected":[{"ecosystem":"Go","package":"github.com/minio/minio","vulnerableRanges":["<0.0.0-20250403145552-8c70975283f9"],"patched":["0.0.0-20250403145552-8c70975283f9"],"from":["GHSA-wg47-6jq2-q2hh","GO-2025-3594"],"provenance":"source"}],"euvd":{"id":"EUVD-2025-9731","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-minio-cve-2023-28434","parents":[{"from":"CVE-2023-28434","to":"CVE-2025-31489","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["cmd/auth-handler.go"],"commits":["https://github.com/minio/minio/commit/67f4ba154a27a1b06e48bfabda38355a010dfca5","https://github.com/minio/minio/commit/8c70975283f9f4ce80f331a25c7475a36279e519"],"basis":"rarely changed file"}]},{"from":"CVE-2024-24747","to":"CVE-2025-31489","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["cmd/auth-handler.go"],"commits":["https://github.com/minio/minio/commit/0ae4915a9391ef4b3ec80f5fcdcf24ee6884e776","https://github.com/minio/minio/commit/8c70975283f9f4ce80f331a25c7475a36279e519"],"basis":"rarely changed file"}]},{"from":"CVE-2024-36107","to":"CVE-2025-31489","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["cmd/object-handlers.go"],"commits":["https://github.com/minio/minio/commit/e0fe7cc391724fc5baa85b45508f425020fe4272","https://github.com/minio/minio/commit/8c70975283f9f4ce80f331a25c7475a36279e519"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2024-36107","published":"2024-05-28","fixed":"0.0.0-20240527191746-e0fe7cc39172","kev":false},{"cve":"CVE-2024-55949","published":"2024-12-16","fixed":"0.0.0-20241213221912-68b004a48f41","kev":false},{"cve":"CVE-2025-27414","published":"2025-02-28","fixed":"0.0.0-20250227184332-4c71f1b4ec0f","kev":false,"link":{"from":"CVE-2025-27414","to":"CVE-2025-31489","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/minio/minio","fromFixed":"0.0.0-20250227184332-4c71f1b4ec0f","toFixed":"0.0.0-20250403145552-8c70975283f9","daysApart":34}]}},{"cve":"CVE-2025-31489","published":"2025-04-03","fixed":"0.0.0-20250403145552-8c70975283f9","kev":false},{"cve":"CVE-2025-62506","published":"2025-10-16","fixed":"0.0.0-20251015170045-c1a49490c78e","kev":false,"link":{"from":"CVE-2025-31489","to":"CVE-2025-62506","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/minio/minio","fromFixed":"0.0.0-20250403145552-8c70975283f9","toFixed":"0.0.0-20251015170045-c1a49490c78e","daysApart":196}]}},{"cve":"CVE-2026-42600","published":"2026-05-11","fixed":"0.0.0-20260414213245","kev":false}],"package":"Go:github.com/minio/minio"}}