CVE-2023-28433

Minio is a Multi-Cloud Object Storage framework. All users on Windows prior to version RELEASE.2023-03-20T20-16-18Z are impacted. MinIO fails to filter the `\` character, which allows for arbitrary object placement across buckets. As a result, a user with low privileges, such as an access key, service account, or STS credential, which only has permission to `PutObject` in a specific bucket, can create an admin user. This issue is patched in RELEASE.2023-03-20T20-16-18Z. There are no known workarounds.

• CWE-668

• https://github.com/minio/minio/commit/8d6558b23649f613414c8527b58973fbdfa4d1b8Patch
• https://github.com/minio/minio/commit/b3c54ec81e0a06392abfb3a1ffcdc80c6fbf6ebcPatch
• https://github.com/minio/minio/releases/tag/RELEASE.2023-03-20T20-16-18ZRelease Notes
• https://github.com/minio/minio/security/advisories/GHSA-w23q-4hw3-2pp6Vendor Advisory
• https://github.com/minio/minio/commit/8d6558b23649f613414c8527b58973fbdfa4d1b8Patch
• https://github.com/minio/minio/commit/b3c54ec81e0a06392abfb3a1ffcdc80c6fbf6ebcPatch
• https://github.com/minio/minio/releases/tag/RELEASE.2023-03-20T20-16-18ZRelease Notes
• https://github.com/minio/minio/security/advisories/GHSA-w23q-4hw3-2pp6Vendor Advisory

Published

Mar 22, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-28428PDFio is a C library for reading and writing PDF files. In v…3.3
• CVE-2023-28429Pimcore is an open source data and experience management pla…6.1
• CVE-2023-2843The MultiParcels Shipping For WooCommerce WordPress plugin b…8.8
• CVE-2023-28430OneSignal is an email, sms, push notification, and in-app me…8.1
• CVE-2023-28431Frontier is an Ethereum compatibility layer for Substrate. F…7.5
• CVE-2023-28432Minio is a Multi-Cloud Object Storage framework. In a cluste…7.5
• CVE-2023-28434Minio is a Multi-Cloud Object Storage framework. Prior to RE…8.8
• CVE-2023-28435Dataease is an open source data visualization and analysis t…6.1
• CVE-2023-28436Tailscale is software for using Wireguard and multi-factor a…8
• CVE-2023-28437Dataease is an open source data visualization and analysis t…9.8
• CVE-2023-28438Pimcore is an open source data and experience management pla…8
• CVE-2023-28439CKEditor4 is an open source what-you-see-is-what-you-get HTM…6.1