https://silo.pgsty.com/tags/path-containment/Recent content in Path Containment on SILOHugoenWed, 05 Aug 2026 07:48:52 +0800https://silo.pgsty.com/blog/security/internode-path-containment/Sun, 02 Aug 2026 00:00:00 +0000https://silo.pgsty.com/blog/security/internode-path-containment/<p><strong>Status:</strong> Fixed on the local <code>pgsty/minio</code> branch, <strong>unreleased and not disclosed</strong> (no CVE/GHSA requested; the upstream repository is archived) <strong>Affected scope:</strong> Distributed erasure only; cluster-root / internode JWT required <strong>Prerequisite reading:</strong> <a href="https://silo.pgsty.com/blog/security/cve-2026-42600/">CVE-2026-42600 · ReadMultiple</a></p> <blockquote> <p>This article contains complete exploitation vectors and measurements. Publishing it constitutes disclosure. Hold it until the fixed release ships.</p> </blockquote> <p><a href="https://silo.pgsty.com/blog/security/cve-2026-42600/">The previous entry</a> closed with this sentence:</p> <blockquote> <p>Deleting the endpoint proves only that <code>ReadMultiple</code> no longer exists. It cannot be extrapolated into a completed containment audit of every internode body path.</p>