Input validation error in minio-java - CVE-2025-59952
Published: October 28, 2025
Vulnerability identifier: #VU117707
CSH Severity: Low
CVSS v4: 2.1 [CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-59952
CWE-ID: CWE-20
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to the application automatically substitutes XML tag values containing references to system properties or environment variables. A remote attacker can pass a specially crafted XML file to the application and obtain sensitive information.
Affected software
minio-java
IBM Observability with Instana
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
Red Hat Camel for Spring Boot
IBM Observability with Instana
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
Red Hat Camel for Spring Boot
How to mitigate CVE-2025-59952
Install updates from vendor's website.
minio-java - update to 8.6.0
IBM Observability with Instana - update to 1.0.309
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 5.3
Red Hat Camel for Spring Boot - addressed in versions 4.10.7, 4.14
IBM Observability with Instana - update to 1.0.309
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 5.3
Red Hat Camel for Spring Boot - addressed in versions 4.10.7, 4.14