{"id":"CVE-2025-59952","title":"MinIO Java SDK is a Simple Storage Service (aka S3) client to perform bucket and object operations to any Amazon S3 compatible object storage service","summary":"MinIO Java SDK is a Simple Storage Service (aka S3) client to perform bucket and object operations to any Amazon S3 compatible object storage service. In minio-java versions prior to 8.6.0, XML tag values containing references to system …","severity":"high","cwe":["CWE-20","CWE-94","CWE-611"],"published":"2025-09-30","updated":"2026-10-09","sourceUpdated":"2026-10-09T09:10:00.213","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-59952","references":[{"url":"https://github.com/minio/minio-java/commit/f7a98d06b25e5464bdd4811b044e25ff9101d37f","label":"security-advisories@github.com"},{"url":"https://github.com/minio/minio-java/releases/tag/8.6.0","label":"security-advisories@github.com"},{"url":"https://github.com/minio/minio-java/security/advisories/GHSA-h7rh-xfpj-hpcm","label":"security-advisories@github.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-59952.json"},{"url":"https://access.redhat.com/security/cve/CVE-2025-59952"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2400380"},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-59952"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-59952"},{"url":"https://access.redhat.com/errata/RHSA-2025:19095"},{"url":"https://access.redhat.com/errata/RHSA-2025:18028"}],"tags":["nvd","csaf","vex","red-hat"],"epss":0.00491,"epssPercentile":0.42019,"ingestedAt":"2026-10-09T09:31:00.994Z","vendor":"Red Hat","product":"Red Hat build of Apache Camel 4 for Quarkus 3","affected":["build_of_apache_camel_4_for_quarkus 3","build_of_apache_camel_4_14_for_quarkus 3.27","build_of_apache_camel_4_10_7_for_spring_boot 3.4.10"],"patched":["build_of_apache_camel_4_14_for_quarkus 3.27","build_of_apache_camel_4_10_7_for_spring_boot 3.4.10"],"cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvssSource":"vendor","slug":"CVE-2025-59952","body":"## Overview\n\nMinIO Java SDK is a Simple Storage Service (aka S3) client to perform bucket and object operations to any Amazon S3 compatible object storage service. In minio-java versions prior to 8.6.0, XML tag values containing references to system properties or environment variables were automatically substituted with their actual values during processing. This unintended behavior could lead to the exposure of sensitive information, including credentials, file paths, or system configuration details, if such references were present in XML content from untrusted sources. This is fixed in version 8.6.0.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **RHSA-2025:19095** · Red Hat · fixed in: Red Hat Build of Apache Camel 4.14 for Quarkus 3.27 · released 2025-10-23 · [advisory](https://access.redhat.com/errata/RHSA-2025:19095)\n- **RHSA-2025:18028** · Red Hat · fixed in: Red Hat build of Apache Camel 4.10.7 for Spring Boot 3.4.10 · released 2025-10-14 · [advisory](https://access.redhat.com/errata/RHSA-2025:18028)\n- **Red Hat VEX** · Important · affected: Red Hat build of Apache Camel 4 for Quarkus 3 · no fix planned: Red Hat build of Apache Camel 4 for Quarkus 3 · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-59952.json)","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":222927,"id":"CVE-2025-59952","ts":1792151712945,"field":"cvss","old":null,"new":"7.5"},{"seq":222926,"id":"CVE-2025-59952","ts":1792151712945,"field":"severity","old":"none","new":"high"}]}