{"id":"CVE-2023-33955","aliases":["EUVD-2023-1573","GHSA-jv3f-7m33-qp65"],"status":"published","title":"Minio console object names with RIGHT-TO-LEFT OVERRIDE unicode character can be exploited","description":"Minio Console is the UI for MinIO Object Storage. Unicode RIGHT-TO-LEFT OVERRIDE characters can be used to mask the original filename. This issue has been patched in version 0.28.0.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00648,"percentile":0.51386,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2023-05-26T13:57:27Z","modified":"2026-06-17T06:02:35Z","fixes":[{"ecosystem":"Go","package":"github.com/minio/console","fixed_in":["0.28.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/minio/console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.28.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/minio/console","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.28.0"}]}]}],"products":[{"vendor":"iidk-the-actual","product":"console"},{"vendor":"minio","product":"console"}],"references":[{"url":"https://github.com/minio/console/security/advisories/GHSA-jv3f-7m33-qp65","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","web"]},{"url":"https://github.com/minio/console/commit/17e791afb90c9ad27c65f63c6be14f2f6a3a9d60","tags":["x_refsource_MISC","x_transferred","Patch","web"]},{"url":"https://github.com/minio/console/releases/tag/v0.28.0","tags":["x_refsource_MISC","x_transferred","Release Notes","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-33955","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-jv3f-7m33-qp65"},{"url":"https://github.com/minio/console","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2023-33955","title":"Minio console object names with RIGHT-TO-LEFT OVERRIDE unicode character can be exploited","description":"Minio Console is the UI for MinIO Object Storage. Unicode RIGHT-TO-LEFT OVERRIDE characters can be used to mask the original filename. This issue has been patched in version 0.28.0.\n\n","status":"published","published":"2023-05-30T06:34:08.578Z","modified":"2025-01-10T18:59:25.56Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:35:34.55015Z"}],"euvd":[{"id":"EUVD-2023-1573","description":"Minio Console is the UI for MinIO Object Storage. Unicode RIGHT-TO-LEFT OVERRIDE characters can be used to mask the original filename. This issue has been patched in version 0.28.0.\n\n","status":"published","published":"2023-05-30T06:34:08Z","modified":"2025-01-10T18:59:25Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T00:04:21.239531Z"}],"ghsa":[{"id":"GHSA-jv3f-7m33-qp65","title":"Minio console object names with RIGHT-TO-LEFT OVERRIDE unicode character can be exploited","description":"### Impact\nUnicode RIGHT-TO-LEFT OVERRIDE characters can be used to mask the original filename.\n\n### Reported-By\nThanks to the report from Mio Li [wulilixi1@gmail.com](mailto:wulilixi1@gmail.com)\n\n### Patches\n```\ncommit 17e791afb90c9ad27c65f63c6be14f2f6a3a9d60\nAuthor: Daniel Valdivia \u003c18384552+dvaldivia@users.noreply.github.com\u003e\nDate:   Tue May 23 08:47:12 2023 -0700\n\n    Replace RIGHT-TO-LEFT OVERRIDE unicode (#2828)\n    \n    Signed-off-by: Daniel Valdivia \u003c18384552+dvaldivia@users.noreply.github.com\u003e\n```\n\n### Workarounds\nWorkarounds are to remove the concerned file and rewrite it properly with the right file and extensions.  Avoid using RTLO characters in your filenames.","status":"published","published":"2023-05-26T13:57:27Z","modified":"2023-11-12T05:00:58Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:37:21.209096Z"}],"nvd":[{"id":"CVE-2023-33955","description":"Minio Console is the UI for MinIO Object Storage. Unicode RIGHT-TO-LEFT OVERRIDE characters can be used to mask the original filename. This issue has been patched in version 0.28.0.\n\n","status":"published","published":"2023-05-30T07:15:10.85Z","modified":"2026-06-17T06:02:35.727Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:08:03.795015Z"}],"osv":[{"id":"GHSA-jv3f-7m33-qp65","title":"Minio console object names with RIGHT-TO-LEFT OVERRIDE unicode character can be exploited","description":"### Impact\nUnicode RIGHT-TO-LEFT OVERRIDE characters can be used to mask the original filename.\n\n### Reported-By\nThanks to the report from Mio Li [wulilixi1@gmail.com](mailto:wulilixi1@gmail.com)\n\n### Patches\n```\ncommit 17e791afb90c9ad27c65f63c6be14f2f6a3a9d60\nAuthor: Daniel Valdivia \u003c18384552+dvaldivia@users.noreply.github.com\u003e\nDate:   Tue May 23 08:47:12 2023 -0700\n\n    Replace RIGHT-TO-LEFT OVERRIDE unicode (#2828)\n    \n    Signed-off-by: Daniel Valdivia \u003c18384552+dvaldivia@users.noreply.github.com\u003e\n```\n\n### Workarounds\nWorkarounds are to remove the concerned file and rewrite it properly with the right file and extensions.  Avoid using RTLO characters in your filenames.","status":"published","published":"2023-05-26T13:57:27Z","modified":"2023-11-08T04:12:42.710587Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:51.10002Z"}]}}