CVE-2026-42600

🗓️ 11 May 2026 20:53:10Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 45 Views🌐 WEB

MinIO path traversal via msgpack in ReadMultiple enables reading outside drive roots; fixed.

Reporter	Title	Published	Views	Family All 15
Chainguard	CVE-2026-42600 vulnerabilities	22 May 202613:18	–	cgr
CNNVD	MinIO 路径遍历漏洞	11 May 202600:00	–	cnnvd
Cvelist	CVE-2026-42600 MinIO: Path Traversal via msgpack Body in `ReadMultiple` Storage-REST Endpoint	11 May 202620:53	–	cvelist
Github Security Blog	MinIO vulnerable to Path Traversal via msgpack Body in `ReadMultiple` Storage-REST Endpoint	5 May 202620:05	–	github
Tenable Nessus	MinIO RELEASE.2022-07-24T01-54-52Z < RELEASE.2026-04-14T21-32-45Z Path Traversal (CVE-2026-42600)	17 Jun 202600:00	–	nessus
NVD	CVE-2026-42600	11 May 202622:22	–	nvd
OSV	BIT-MINIO-2026-42600 MinIO: Path Traversal via msgpack Body in `ReadMultiple` Storage-REST Endpoint	13 May 202615:13	–	osv
OSV	CGA-4X78-55VJ-GG9J	22 May 202612:42	–	osv
OSV	GHSA-XH8F-G2QW-GCM7 MinIO vulnerable to Path Traversal via msgpack Body in `ReadMultiple` Storage-REST Endpoint	5 May 202620:05	–	osv
OSV	GO-2026-5757 MinIO vulnerable to Path Traversal via msgpack Body in `ReadMultiple` Storage-REST Endpoint in github.com/minio/minio	25 Jun 202622:34	–	osv

NVD

Vulners

Node

minio minioRange2022-07-24t01-54-52z–2026-04-14t21-32-45z

[
  {
    "vendor": "minio",
    "product": "minio",
    "versions": [
      {
        "version": ">= RELEASE.2022-07-24T01-54-52Z, < RELEASE.2026-04-14T21-32-45Z",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/minio/minio/security/advisories/GHSA-xh8f-g2qw-gcm7

Parameter	Position	Path	Description	CWE
Bucket	request body	minio/storage/{drivePath}/v63/rmpl	Path traversal in ReadMultiple endpoint allows reading files outside configured drive roots via Bucket field in a msgpack-encoded request body.	CWE-22

17 Jun 2026 10:48Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.14.9

CVSS 46.9

EPSS0.08457

SSVC

CWE-22