CVE-2023-33955— Minio console object names with RIGHT-TO-LEFT OVERRIDE unicode character can be exploited
Quick assessment
Affected
minio console
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
MinIO是美国MinIO公司的一款开源的对象存储服务器。该产品支持构建用于机器学习、分析和应用程序数据工作负载的基础架构。 Minio Console 0.28.0之前版本存在安全漏洞，该漏洞源于Unicode RIGHT-TO-LEFT OVERRIDE 字符可用于屏蔽原始文件名。
Possible ATT&CK Techniques 1 AI
T1067
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2023-33955
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Minio console object names with RIGHT-TO-LEFT OVERRIDE unicode character can be exploited
Source: CVE Program / CVE List V5
Vulnerability Description
Minio Console is the UI for MinIO Object Storage. Unicode RIGHT-TO-LEFT OVERRIDE characters can be used to mask the original filename. This issue has been patched in version 0.28.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5
Vulnerability Title
MinIO 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
MinIO是美国MinIO公司的一款开源的对象存储服务器。该产品支持构建用于机器学习、分析和应用程序数据工作负载的基础架构。 Minio Console 0.28.0之前版本存在安全漏洞，该漏洞源于Unicode RIGHT-TO-LEFT OVERRIDE 字符可用于屏蔽原始文件名。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2023-33955
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-33955
请登录查看更多情报信息。
Patches & Fixes for CVE-2023-33955 (1)
Vendor Advisories for CVE-2023-33955 (1)
-
https://github.com/minio/console/security/advisories/GHSA-jv3f-7m33-qp65 x_refsource_CONFIRM
Other References for CVE-2023-33955 (1)
-
https://github.com/minio/console/releases/tag/v0.28.0 x_refsource_MISC
IV. Related Vulnerabilities
Same product: console
-
CVE-2026-62378
RustFS Console: Critical Stored XSS in Preview Modal leading -
CVE-2025-65952
Console is vulnerable to path traversal regarding custom ass -
CVE-2025-4365
NetScaler Console and NetScaler SDX (SVM) - Arbitrary file r -
CVE-2024-12284
Authenticated privilege escalation -
CVE-2014-125078
yanheven console horizon.instances.js cross site scripting
Same vendor: minio
-
CVE-2026-97731
MinIO<7aac2a2越权复制漏洞 -
CVE-2026-42600
MinIO: Path Traversal via msgpack Body in `ReadMultiple` Sto -
CVE-2026-41145
MinIO has an Unauthenticated Object Write via Query-String C -
CVE-2026-40344
MinIO has an Unauthenticated Object Write via Missing Signat -
CVE-2026-39414
MinIO affected a DoS via Unbounded Memory Allocation in S3 S
Same weakness: CWE-200
-
CVE-2026-89097
Ad Inserter <= 2.8.18 - Authenticated (Subscriber+) Sensitiv -
CVE-2026-17484
IBM i is Information Disclosure -
CVE-2026-17487
IBM i is Information Disclosure -
CVE-2026-75076
IBM Aspera Enterprise Webapps Information Disclosure -
CVE-2026-93892
Security Vulnerability identified in IBM TRIRIGA - Informati
V. Comments for CVE-2023-33955
No comments yet