https://silo.pgsty.com/tags/storage-rest/Recent content in Storage REST on SILOHugoenSun, 02 Aug 2026 15:22:46 +0800https://silo.pgsty.com/blog/security/cve-2026-42600/Fri, 12 Jun 2026 00:00:00 +0000https://silo.pgsty.com/blog/security/cve-2026-42600/<p><strong>Status:</strong> Released<br> <strong>First containing release:</strong> <a href="https://github.com/pgsty/minio/releases/tag/RELEASE.2026-06-18T00-00-00Z">RELEASE.2026-06-18T00-00-00Z</a><br> <strong>GitHub advisory:</strong> <a href="https://github.com/advisories/GHSA-xh8f-g2qw-gcm7">GHSA-xh8f-g2qw-gcm7</a><br> <strong>Affected scope:</strong> Distributed erasure only; cluster-root / internode JWT required</p> <p>The msgpack body of <code>/rmpl</code> carried <code>Bucket</code>, <code>Prefix</code>, and <code>Files</code>. The old code joined those values into filesystem paths without a containment check. The initial fix implemented full preflight validation. Continued call-chain review then found that this API had had no production caller since 2024. The final solution changed from “retain and harden” to removing the route, handler, client, interface, and generated code.</p>