GHSA-h7rh-xfpj-hpcm: 
Java vulnerability analysis and mitigation

MinIO Java SDK, a Simple Storage Service (S3) client for performing bucket and object operations, was found to contain a vulnerability in versions prior to 8.6.0. The vulnerability (CVE-2025-59952) was discovered and disclosed on September 29, 2025, affecting the XML processing functionality of the minio-java library. The vulnerability allowed XML tag values containing references to system properties or environment variables to be automatically substituted with their actual values during processing (GitHub Advisory, NVD).

The vulnerability stems from the default behavior of the org.simpleframework.xml.core.Persister class used for XML serialization and deserialization in minio-java. The class automatically substitutes placeholders in the format ${...} with values of system properties or environment variables. The vulnerability received a CVSS v4.0 base score of 8.7 (High) with the vector string CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N. The issue was identified with CWE-20 (Improper Input Validation) and CWE-94 (Improper Control of Generation of Code) (RedHat Security, GitHub Advisory).

The vulnerability poses a high risk of information disclosure. Attackers could craft malicious XML inputs to extract sensitive data from the system's properties or environment variables, potentially compromising security in applications relying on minio-java for object storage operations. This could lead to the exposure of sensitive information, including credentials, file paths, or system configuration details (GitHub Advisory).

The vulnerability has been patched in minio-java version 8.6.0, where automatic substitution of XML tag values with system properties or environment variables has been disabled. Users are strongly advised to upgrade to version 8.6.0 or later. For systems that cannot immediately upgrade, interim measures include refraining from processing XML data from untrusted sources and implementing input sanitization to detect and remove references to system properties or environment variables in XML content (GitHub Release, GitHub Advisory).