{"id":"CVE-2025-31489","aliases":["GHSA-wg47-6jq2-q2hh","BIT-minio-2025-31489","GO-2025-3594"],"title":"MinIO performs incomplete signature validation for unsigned-trailer uploads","summary":"MinIO performs incomplete signature validation for unsigned-trailer uploads","severity":"high","vendor":"minio","product":"github.com/minio/minio","ecosystem":"go","affected":["github.com/minio/minio < 0.0.0-20250403145552-8c70975283f9"],"patched":["github.com/minio/minio 0.0.0-20250403145552-8c70975283f9"],"published":"2025-04-04","updated":"2026-08-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-wg47-6jq2-q2hh","references":[{"url":"https://github.com/minio/minio/security/advisories/GHSA-wg47-6jq2-q2hh"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-31489"},{"url":"https://github.com/minio/minio/pull/21103"},{"url":"https://github.com/minio/minio/commit/8c70975283f9f4ce80f331a25c7475a36279e519"},{"url":"https://github.com/minio/minio"}],"tags":["osv","go","exploit-available"],"epss":0.02428,"epssPercentile":0.83512,"ingestedAt":"2026-08-07T19:14:17.827Z","exploits":{"nuclei":["CVE-2025-31489"],"checkedAt":"2026-09-23T07:13:35.603Z"},"exploitAvailable":true,"slug":"CVE-2025-31489","body":"## Overview\n\n### Impact\nThis is a high priority vulnerability and users must upgrade ASAP.\n\nThe signature component of the authorization may be invalid, which would mean that as a client you can use any arbitrary secret to upload objects given the user already has prior WRITE permissions on the bucket,\n\nPrior knowledge of access-key, and bucket name this user might have access to - and an access-key with a WRITE permissions is necessary.\n\nHowever with relevant information in place, uploading random objects to buckets is trivial and easy via `curl`\n\n### Patches\nYes https://github.com/minio/minio/pull/21103\n\n### Workarounds\nReject requests with `x-amz-content-sha256: STREAMING-UNSIGNED-PAYLOAD-TRAILER` for now at LB layer, ask application users to use `STREAMING-AWS4-HMAC-SHA256-PAYLOAD-TRAILER`\n\n## Affected packages\n\n- `github.com/minio/minio < 0.0.0-20250403145552-8c70975283f9`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/minio/minio 0.0.0-20250403145552-8c70975283f9`","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":41.3,"likelihood":0.5,"exploitation":12,"ransomware":0},"changes":[{"seq":4809,"id":"CVE-2025-31489","ts":1788887208157,"field":"exploit_available","old":"false","new":"true"},{"seq":3692,"id":"CVE-2025-31489","ts":1788886325175,"field":"exploit_available","old":"true","new":"false"},{"seq":2537,"id":"CVE-2025-31489","ts":1788883006821,"field":"exploit_available","old":"false","new":"true"},{"seq":1566,"id":"CVE-2025-31489","ts":1788882407068,"field":"exploit_available","old":"true","new":"false"},{"seq":680,"id":"CVE-2025-31489","ts":1788881843774,"field":"exploit_available","old":"false","new":"true"}]}