---
id: CVE-2025-59952
title: >-
  MinIO Java SDK is a Simple Storage Service (aka S3) client to perform bucket
  and object operations to any Amazon S3 compatible object storage service
summary: >-
  MinIO Java SDK is a Simple Storage Service (aka S3) client to perform bucket
  and object operations to any Amazon S3 compatible object storage service. In
  minio-java versions prior to 8.6.0, XML tag values containing references to
  system …
severity: high
cwe:
  - CWE-20
  - CWE-94
  - CWE-611
published: '2025-09-30'
updated: '2026-10-09'
sourceUpdated: '2026-10-09T09:10:00.213'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-59952'
references:
  - url: >-
      https://github.com/minio/minio-java/commit/f7a98d06b25e5464bdd4811b044e25ff9101d37f
    label: security-advisories@github.com
  - url: 'https://github.com/minio/minio-java/releases/tag/8.6.0'
    label: security-advisories@github.com
  - url: >-
      https://github.com/minio/minio-java/security/advisories/GHSA-h7rh-xfpj-hpcm
    label: security-advisories@github.com
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-59952.json
  - url: 'https://access.redhat.com/security/cve/CVE-2025-59952'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2400380'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2025-59952'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-59952'
  - url: 'https://access.redhat.com/errata/RHSA-2025:19095'
  - url: 'https://access.redhat.com/errata/RHSA-2025:18028'
tags:
  - nvd
  - csaf
  - vex
  - red-hat
epss: 0.00491
epssPercentile: 0.42019
ingestedAt: '2026-10-09T09:31:00.994Z'
vendor: Red Hat
product: Red Hat build of Apache Camel 4 for Quarkus 3
affected:
  - build_of_apache_camel_4_for_quarkus 3
  - build_of_apache_camel_4_14_for_quarkus 3.27
  - build_of_apache_camel_4_10_7_for_spring_boot 3.4.10
patched:
  - build_of_apache_camel_4_14_for_quarkus 3.27
  - build_of_apache_camel_4_10_7_for_spring_boot 3.4.10
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cvssSource: vendor
---

## Overview

MinIO Java SDK is a Simple Storage Service (aka S3) client to perform bucket and object operations to any Amazon S3 compatible object storage service. In minio-java versions prior to 8.6.0, XML tag values containing references to system properties or environment variables were automatically substituted with their actual values during processing. This unintended behavior could lead to the exposure of sensitive information, including credentials, file paths, or system configuration details, if such references were present in XML content from untrusted sources. This is fixed in version 8.6.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **RHSA-2025:19095** · Red Hat · fixed in: Red Hat Build of Apache Camel 4.14 for Quarkus 3.27 · released 2025-10-23 · [advisory](https://access.redhat.com/errata/RHSA-2025:19095)
- **RHSA-2025:18028** · Red Hat · fixed in: Red Hat build of Apache Camel 4.10.7 for Spring Boot 3.4.10 · released 2025-10-14 · [advisory](https://access.redhat.com/errata/RHSA-2025:18028)
- **Red Hat VEX** · Important · affected: Red Hat build of Apache Camel 4 for Quarkus 3 · no fix planned: Red Hat build of Apache Camel 4 for Quarkus 3 · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-59952.json)