Affected: minio

MinIO is a high-performance object storage system. From RELEASE.2022-07-24T01-54-52Z to before RELEASE.2026-04-14T21-32-45Z, A path traversal vulnerability in MinIO's ReadMultiple internode storage-REST endpoint allows a caller holding the cluster root JWT to read files from outside the configured drive roots, bounded only by the MinIO process UID. The attacker sends POST minio/storage/{drivePath}/v63/rmpl with a msgpack-encoded body carrying ../ sequences in the Bucket field. The server opens the resulting path via os.OpenFile with O_RDONLY|O_NOATIME and returns its contents in the msgpack response stream. This vulnerability is fixed in RELEASE.2026-04-14T21-32-45Z.

Affected: Go: github.com/minio/minio

### Impact

_What kind of vulnerability is it? Who is impacted?_

A path traversal vulnerability in MinIO's `ReadMultiple` internode storage-REST endpoint allows a caller holding the cluster root JWT to read files from outside the configured drive roots, bounded only by the MinIO process UID.

Distributed-erasure (multi-node) MinIO deployments are impacted. Single-node standalone deployments do not register the route and are not affected. The attack requires an HS512 JWT signed with `MINIO_ROOT_PASSWORD` and carrying `accessKey = MINIO_ROOT_USER` — the same secret every peer in the cluster holds to authenticate internode traffic, so a compromised peer or any actor in possession of the root credential can mint one.

The `ReadMultiple` handler (`cmd/storage-rest-server.go`) decodes a msgpack `ReadMultipleReq` body containing `Bucket`, `Prefix`, and `Files` fields and forwards them to `xlStorage.ReadMultiple` (`cmd/xl-storage.go`) without validation:

```go volumeDir := pathJoin(s.drivePath, req.Bucket) // traversal resolves here for _, f := range req.Files { fullPath := pathJoin(volumeDir, req.Prefix, f) data, mt, err = s.readAllDataWithDMTime(ctx, req.Bucket, volumeDir, fullPath) } ```

`pathJoin` calls `path.Clean`, which resolves `..` components and produces an absolute path anywhere on the filesystem — it is not a root jail. The global `setRequestValidityMiddleware` rejects `..` in `r.URL.Path` and `r.Form` but does not inspect request bodies, so msgpack-e…