Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
CVE-2023-33955: MinIO Console allows filename manipulation through Unicode characters
CVE-2023-33955 · published 3 years ago
Summary
An attacker can use special Unicode characters to disguise file names in the MinIO Console, potentially leading to unintended file access or other security issues. This issue has been fixed in version 0.28.0, so upgrade to this version to protect your system. If you can't upgrade immediately, take extra precautions when handling files in the console.
What to do
- Update github.com minio to version 0.28.0.
- Update minio console to version 0.28.0 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| go | github.com | minio |
< 0.28.0 Fix: upgrade to 0.28.0
|
| – | minio | console |
< 0.28.0 cpe:2.3:a:minio:console:*:*:*:*:*:*:*:* |
Original advisory text
Minio console object names with RIGHT-TO-LEFT OVERRIDE unicode character can be exploited
Minio Console is the UI for MinIO Object Storage. Unicode RIGHT-TO-LEFT OVERRIDE characters can be used to mask the original filename. This issue has been patched in version 0.28.0.
References
- https://nvd.nist.gov/vuln/detail/CVE-2023-33955
- https://github.com/advisories/GHSA-jv3f-7m33-qp65
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/33xxx/CVE-2023-33955... Vendor Advisory
- https://github.com/minio/console/commit/17e791afb90c9ad27c65f63c6be14f2f6a3a9d60 Patch
- https://github.com/minio/console/releases/tag/v0.28.0 Release Notes
- https://github.com/minio/console/security/advisories/GHSA-jv3f-7m33-qp65 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
5.3
Medium
Type
CWE-200Information Exposure
Timeline
Published30 May 2023
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta