https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T01:53:51.675169+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2023-07540 bdu:2023-07540 2026-10-03T01:53:51.788474+00:00 bdu:2023-07540 https://cve.radiocsirt.org/vuln/bit-minio-2023-28433 BIT-minio-2023-28433 — Minio Privilege Escalation on Windows via Path separator manipulation 2026-10-03T01:53:51.788518+00:00

Affected: Bitnami: minio

Minio is a Multi-Cloud Object Storage framework. All users on Windows prior to version RELEASE.2023-03-20T20-16-18Z are impacted. MinIO fails to filter the `\` character, which allows for arbitrary object placement across buckets. As a result, a user with low privileges, such as an access key, service account, or STS credential, which only has permission to `PutObject` in a specific bucket, can create an admin user. This issue is patched in RELEASE.2023-03-20T20-16-18Z. There are no known workarounds.

 https://cve.radiocsirt.org/vuln/euvd-2026-218827 EUVD-2026-218827 2026-10-03T01:53:51.788556+00:00 EUVD-2026-218827 https://cve.radiocsirt.org/vuln/fkie_cve-2023-28433 fkie_cve-2023-28433 2026-10-03T01:53:51.788576+00:00

Minio is a Multi-Cloud Object Storage framework. All users on Windows prior to version RELEASE.2023-03-20T20-16-18Z are impacted. MinIO fails to filter the `\` character, which allows for arbitrary object placement across buckets. As a result, a user with low privileges, such as an access key, service account, or STS credential, which only has permission to `PutObject` in a specific bucket, can create an admin user. This issue is patched in RELEASE.2023-03-20T20-16-18Z. There are no known workarounds.

 https://cve.radiocsirt.org/vuln/ghsa-w23q-4hw3-2pp6 GHSA-w23q-4hw3-2pp6 — Minio vulnerable to Privilege Escalation on Windows via Path separator manipulation 2026-10-03T01:53:51.788600+00:00

Affected: Go: github.com/minio/minio

### Impact All users on Windows are impacted. MinIO fails to filter the `\` character, which allows for arbitrary object placement across buckets. As a result, a user with low privileges, such as an access key, service account, or STS credential, which only has permission to `PutObject` in a specific bucket, can create an admin user.

### Patches There are two patches that fix this problem comprehensively

``` commit b3c54ec81e0a06392abfb3a1ffcdc80c6fbf6ebc Author: Harshavardhana <harsha@minio.io> Date: Mon Mar 20 13:16:00 2023 -0700

reject object names with '\' on windows (#16856) ```

``` commit 8d6558b23649f613414c8527b58973fbdfa4d1b8 Author: Harshavardhana <harsha@minio.io> Date: Mon Mar 20 00:35:25 2023 -0700

fix: convert '\' to '/' on windows (#16852) ```

### Workarounds There are no known workarounds

### References The vulnerable code: ```go // minio/cmd/generic-handlers.go // Check if the incoming path has bad path components, // such as ".." and "." // SlashSeparator -> / // dotdotComponent -> .. // dotComponent -> . func hasBadPathComponent(path string) bool { path = strings.TrimSpace(path) for _, p := range strings.Split(path, SlashSeparator) { switch strings.TrimSpace(p) { case dotdotComponent: return true case dotComponent: return true } } return false } ```

 https://cve.radiocsirt.org/vuln/gsd-2023-28433 gsd-2023-28433 2026-10-03T01:53:51.788641+00:00 gsd-2023-28433 https://cve.radiocsirt.org/vuln/ubuntu-cve-2023-28433 UBUNTU-CVE-2023-28433 2026-10-03T01:53:51.788654+00:00

Affected: Ubuntu:Pro:18.04:LTS: golang-github-minio-minio-go, Ubuntu:20.04:LTS: golang-github-minio-minio-go, Ubuntu:22.04:LTS: golang-github-minio-minio-go, Ubuntu:22.04:LTS: golang-github-minio-minio-go-v7, Ubuntu:24.10: golang-github-minio-minio-go, Ubuntu:24.10: golang-github-minio-minio-go-v7, Ubuntu:24.04:LTS: golang-github-minio-minio-go, Ubuntu:24.04:LTS: golang-github-minio-minio-go-v7

Minio is a Multi-Cloud Object Storage framework. All users on Windows prior to version RELEASE.2023-03-20T20-16-18Z are impacted. MinIO fails to filter the `\` character, which allows for arbitrary object placement across buckets. As a result, a user with low privileges, such as an access key, service account, or STS credential, which only has permission to `PutObject` in a specific bucket, can create an admin user. This issue is patched in RELEASE.2023-03-20T20-16-18Z. There are no known workarounds.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-2282 WID-SEC-W-2023-2282 — MinIO: Schwachstelle ermöglicht Privilegieneskalation 2026-10-03T01:53:51.788686+00:00

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in MinIO ausnutzen, um seine Privilegien zu erhöhen.