8.7

CVE-2025-31489: minio

CVSS: 8.7v4.0HighDeferred
AliasesGHSA-wg47-6jq2-q2hhGO-2025-3594
Published 03-04-2025Last modified 03-04-2025
Open JSON

Vulnerability summary

CVE-2025-31489 is a high (CVSS 8.7) vulnerability in minio. EPSS estimates a 2.47% chance of exploitation in the next 30 days, higher than 84.3% of scored vulnerabilities.

Overall risk
35/100
0100
Medium · default modelHow is this calculated?
CVSS score
8.7/10
010
High · v4.0 (CVE.org)
EPSS score
2.47%
0%100%
Low · +0.04 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1 · Related 2
OPENSUSE-SU-2025:14982-1CGA-C9V9-H7QX-39W7

Timeline

  1. 03-04-2025
    PublishedVulnerability first disclosed.
  2. 03-04-2025
    Last modifiedVulnerability information updated.

Description

MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. The signature component of the authorization may be invalid, which would mean that as a client you can use any arbitrary secret to upload objects given the user already has prior WRITE permissions on the bucket. Prior knowledge of access-key, and bucket name this user might have access to - and an access-key with a WRITE permissions is necessary. However with relevant information in place, uploading random objects to buckets is trivial and easy via curl. This issue is fixed in RELEASE.2025-04-03T14-56-28Z.

CVSS metrics

3 scores · 3 sources · 1 version

EPSS trend

Probability

2.47%

Chance of exploitation in the next 30 days

Percentile

84%

Versus all other CVEs

30-day change

+0.04 pp

From 2.43% on 22-09-2026

22-09-202622-10-2026
EPSS score
2.47%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Github.com/minio1 product
  • minio< 0.0.0-20250403145552-8c70975283f9
Minio1 product
  • minio< RELEASE.2025-04-03T14-56-28Z

2 vendors · 2 products

References

5 links