CVE-2025-31489 MinIO performs incomplete signature validation for unsigned-trailer uploads
Attackers with WRITE permissions can upload arbitrary objects by bypassing signature validation, requiring prior knowledge of access keys and bucket names.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-31489?
CVE-2025-31489 is a high-severity authentication bypass vulnerability in minio, published on 3 Apr 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. The signature component of the authorization may be invalid, which would mean that as a client you can use any arbitrary secret to upload objects given the user already has prior WRITE permissions on the bucket. Prior knowledge of access-key, and bucket name this user might have access to - and an access-key with a WRITE permissions is necessary. However with relevant information in place, uploading random objects to buckets is trivial and easy via curl. This issue is fixed in RELEASE.2025-04-03T14-56-28Z.
Weakness: CWE-347
Which versions are affected by CVE-2025-31489?
3 open source packages ship an affected version, including github.com/minio/minio.
| Package | Affected | Fixed in |
|---|---|---|
github.com/minio/minio Go | All versions | 0.0.0-20250403145552-8c70975283f9 |
github.com/minio/minio Go | All versions | 0.0.0-20250403145552-8c70975283f9 |
github.com/minio/minio Go | All versions | 0.0.0-20250403145552-8c70975283f9 |
How do I fix CVE-2025-31489?
Upgrade github.com/minio/minio to 0.0.0-20250403145552-8c70975283f9 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-31489 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-31489 exists.
Public exploit code: 1 Nuclei template.
Sources
Also known as GHSA-wg47-6jq2-q2hh, GO-2025-3594.