CVE-2025-59952: MinIO Java SDK Information Disclosure Flaw

CVE-2025-59952 Overview

CVE-2025-59952 is an information disclosure vulnerability in the MinIO Java SDK, an S3-compatible client library used to perform bucket and object operations against Amazon S3 and compatible object storage services. In minio-java versions prior to 8.6.0, the XML serializer automatically substituted system property and environment variable references found in XML tag values with their runtime values. When XML content originated from untrusted sources, this behavior could leak credentials, file paths, and system configuration details. The issue is classified as improper input validation [CWE-20] and is fixed in minio-java version 8.6.0.

Critical Impact
Attackers controlling XML content processed by minio-java can extract environment variables and system properties, exposing secrets such as AWS credentials, API keys, and internal paths.

Affected Products

MinIO Java SDK (minio-java) versions prior to 8.6.0
Java applications using io.minio.Xml for marshalling or unmarshalling S3 XML payloads
Downstream services that pass untrusted XML through the MinIO Java client

Discovery Timeline

2025-09-30 - CVE-2025-59952 published to the National Vulnerability Database (NVD)
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-59952

Vulnerability Analysis

The MinIO Java SDK uses the Simple XML framework (org.simpleframework.xml) to marshal and unmarshal S3-compatible XML payloads. Simple XML supports a templating feature that expands tokens of the form ${name} inside element values by consulting a Filter chain. The default filter consults system properties and environment variables, returning their values if a matching key exists.

Because minio-java instantiated Persister without supplying a no-op filter, any XML content processed by the SDK would have these tokens silently replaced. The vulnerability is an input validation flaw [CWE-20] rooted in trusting the default behavior of the XML framework.

Root Cause

The Xml class constructed its serializer using new Persister(new AnnotationStrategy(), new Format(0)), which leaves Simple XML's default template engine active. The default engine resolves ${PROP} references against System.getProperty() and System.getenv(). Attackers placing such references in XML returned from a malicious or compromised S3 endpoint cause the SDK to inline sensitive runtime values into objects it deserializes or re-marshals.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An adversary capable of returning XML responses to a client using minio-java, for example through a malicious or man-in-the-middle S3 endpoint, embeds tokens such as <Owner>${AWS_SECRET_ACCESS_KEY}</Owner> in responses. When the SDK parses and re-emits the XML, the substituted values are written into application logs, error messages, or subsequent requests, exfiltrating secrets back to attacker-controlled infrastructure.

java

// Patch from api/src/main/java/io/minio/Xml.java
// xml: disable property/environment variable substitution (#1667)
import org.simpleframework.xml.filter.Filter;

public class Xml {
  private static final Filter noopFilter =
      new Filter() {
        @Override
        public String replace(String name) {
          return null;
        }
      };

  public static String marshal(Object source) throws XmlParserException {
    try {
      Serializer serializer = new Persister(new AnnotationStrategy(), noopFilter, new Format(0));
      StringWriter writer = new StringWriter();
      serializer.write(source, writer);
      return writer.toString();
    }
    // ...
  }
}

Source: GitHub commit f7a98d0. The fix passes a noopFilter that returns null for every token, disabling property and environment variable expansion.

Detection Methods for CVE-2025-59952

Indicators of Compromise

Outbound XML payloads or application logs containing values matching local environment variables, such as AWS_SECRET_ACCESS_KEY, DB_PASSWORD, or JAVA_HOME
Inbound S3 XML responses containing ${...} token patterns inside element values
HTTP requests issued by minio-java that include resolved secrets in headers, query strings, or object metadata

Detection Strategies

Perform software composition analysis (SCA) on Java projects to flag io.minio:minio dependencies below version 8.6.0
Inspect network traffic to S3 endpoints for XML response bodies containing ${ token sequences
Review application logs and S3 audit trails for object names, ACL grantee fields, or error responses that echo environment variable contents

Monitoring Recommendations

Alert on S3 client traffic terminating at unexpected or newly observed endpoints
Monitor JVM processes loading minio-java JAR files prior to 8.6.0 via runtime asset inventory
Capture and review outbound requests for known secret prefixes such as AKIA, ASIA, or internal credential formats

How to Mitigate CVE-2025-59952

Immediate Actions Required

Upgrade io.minio:minio to version 8.6.0 or later in all Maven and Gradle builds
Rotate any credentials, API keys, or tokens accessible through JVM system properties or environment variables on hosts that processed untrusted XML
Audit S3 endpoint configurations to ensure clients only communicate with trusted, TLS-validated servers

Patch Information

The fix is delivered in minio-java release 8.6.0. The patch, tracked in GHSA-h7rh-xfpj-hpcm, introduces a no-op Filter in io.minio.Xml so the Simple XML Persister no longer substitutes ${...} references with system property or environment variable values.

Workarounds

Restrict network egress so minio-java only reaches trusted S3 endpoints, reducing exposure to malicious XML responses
Remove sensitive values from JVM system properties and process environment variables, sourcing them from a runtime secret store instead
Validate or strip ${ token sequences from XML payloads before passing them to the SDK if upgrading is not immediately possible

bash

# Maven: upgrade minio-java to the patched release
mvn versions:use-dep-version -Dincludes=io.minio:minio -DdepVersion=8.6.0 -DforceVersion=true

# Gradle: pin the patched version
# build.gradle
# implementation 'io.minio:minio:8.6.0'

# Verify the resolved version
mvn dependency:tree | grep io.minio