---
id: CVE-2025-31489
aliases:
  - GHSA-wg47-6jq2-q2hh
  - BIT-minio-2025-31489
  - GO-2025-3594
title: MinIO performs incomplete signature validation for unsigned-trailer uploads
summary: MinIO performs incomplete signature validation for unsigned-trailer uploads
severity: high
vendor: minio
product: github.com/minio/minio
ecosystem: go
affected:
  - github.com/minio/minio < 0.0.0-20250403145552-8c70975283f9
patched:
  - github.com/minio/minio 0.0.0-20250403145552-8c70975283f9
published: '2025-04-04'
updated: '2026-08-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-wg47-6jq2-q2hh'
references:
  - url: 'https://github.com/minio/minio/security/advisories/GHSA-wg47-6jq2-q2hh'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-31489'
  - url: 'https://github.com/minio/minio/pull/21103'
  - url: >-
      https://github.com/minio/minio/commit/8c70975283f9f4ce80f331a25c7475a36279e519
  - url: 'https://github.com/minio/minio'
tags:
  - osv
  - go
  - exploit-available
epss: 0.02428
epssPercentile: 0.83535
ingestedAt: '2026-08-07T19:14:17.827Z'
exploits:
  nuclei:
    - CVE-2025-31489
  checkedAt: '2026-09-24T07:52:53.234Z'
exploitAvailable: true
---

## Overview

### Impact
This is a high priority vulnerability and users must upgrade ASAP.

The signature component of the authorization may be invalid, which would mean that as a client you can use any arbitrary secret to upload objects given the user already has prior WRITE permissions on the bucket,

Prior knowledge of access-key, and bucket name this user might have access to - and an access-key with a WRITE permissions is necessary.

However with relevant information in place, uploading random objects to buckets is trivial and easy via `curl`

### Patches
Yes https://github.com/minio/minio/pull/21103

### Workarounds
Reject requests with `x-amz-content-sha256: STREAMING-UNSIGNED-PAYLOAD-TRAILER` for now at LB layer, ask application users to use `STREAMING-AWS4-HMAC-SHA256-PAYLOAD-TRAILER`

## Affected packages

- `github.com/minio/minio < 0.0.0-20250403145552-8c70975283f9`

## Remediation

Upgrade to a patched release:

- `github.com/minio/minio 0.0.0-20250403145552-8c70975283f9`