CVE-2022-35919: MinIO ServerUpdate path traversal exposes arbitrary readable files

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

medium priorityExploitation requires an already-privileged admin account and yields read-only disclosure, but public exploit material and a high EPSS score raise the practical risk.

What it is

MinIO contains a path traversal flaw (CWE-22) where an admin user authorized for the admin:ServerUpdate action can trigger an error that returns the content of an arbitrary requested path. Because the MinIO process can read files anywhere the OS account permits, this leaks host files to an authenticated administrator. The issue is fixed in later versions, and the advisory notes a workaround for those who cannot upgrade.

Impact

An attacker with admin:ServerUpdate rights gains read access to any file readable by the MinIO process on the underlying host, potentially exposing configuration, credentials or other sensitive data. There is no integrity or availability impact per the CVSS vector.

Attack surface

Reached over the network via the MinIO admin API (AV:N) and requires high privileges, specifically an admin account holding admin:ServerUpdate (PR:H); no user interaction is needed (UI:N).

Exploitation

CISA KEV does not list this CVE, but EPSS is high (0.52334, ~98.9th percentile) and the GitHub security advisory is tagged Exploit, indicating public exploit material exists. No ransomware association is documented.

What to do

• Upgrade MinIO to a version containing the fix (commit bc72e4226e669d98c8e0f3eccc9297be9251c692 / PR 15429).
• If upgrading is not possible, deny the admin:ServerUpdate action for admin users via IAM policies to disable the ServerUpdate API.
• Restrict admin API access to trusted networks and limit the number of accounts holding admin:ServerUpdate.
• Run the MinIO process under a least-privilege OS account so files outside its data directories are not readable.
• Review IAM policies for any admin users retaining ServerUpdate rights after remediation.

Detection

• Monitor MinIO admin API calls invoking ServerUpdate, especially those returning error responses with file content.
• Alert on admin:ServerUpdate usage by accounts that do not normally perform server updates.
• Watch for anomalous reads of host files by the MinIO process user (e.g., auditd or EDR file access telemetry).
• Correlate MinIO audit logs for path-like or traversal sequences in ServerUpdate requests.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.