StackRadar

CVE-2025-59952

High

Advisory

Published 29 Sept 2025In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
8.7
base score, highest
EPSS
0.005
41st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
14
of 17,781 indexed, latest versions
Container images
16
deployed by those charts
Fix available
1 of 1
affected package

MinIO Java Client XML Tag Value Substitution Vulnerability

Carried by container images the latest versions of 14 of 17,781 indexed charts deploy, on 16 images.

Affected packageAffected versionsFixed inImages
miniomaven5.0.1, 6.0.10, 6.0.13, 7.1.0+8 more8.6.016
OSV records
GHSA-h7rh-xfpj-hpcm

Charts affected

14 by stars
ChartLatestAffected imagesRadar Score
glasskube-operatorglasskubeOfficialVerified publisher0.12.21 of 3See more

glasskube-operator glasskube 0.12.2

1 of the 3 container images this version deploys carry CVE-2025-59952.

Container imageDigestPackageFixed in
glasskube/operator:0.12.2be5133100d63
minio@8.5.6
8.6.0

Open the chart page →

11,933
feedbacksystemthm-mni-iiVerified publisher0.47.11 of 10See more

feedbacksystem thm-mni-ii 0.47.1

1 of the 10 container images this version deploys carry CVE-2025-59952.

Container imageDigestPackageFixed in
thmmniii/fbs-core:v1.27.15438517d9fc2
minio@8.5.4
8.6.0

Open the chart page →

28,534
atlas-cmmsf3k-techVerified publisher0.151.51 of 4See more

atlas-cmms f3k-tech 0.151.5

1 of the 4 container images this version deploys carry CVE-2025-59952.

Container imageDigestPackageFixed in
intelloop/atlas-cmms-backend:v1.5.14c61bc3dd3f8
minio@8.5.17
8.6.0

Open the chart page →

5,291
portraitportraitVerified publisher0.2.131 of 8See more

portrait portrait 0.2.13

1 of the 8 container images this version deploys carry CVE-2025-59952.

Container imageDigestPackageFixed in
treskon/portrait:DEV-latest88e813f22347
minio@8.5.8
8.6.0

Open the chart page →

31,844
starwhalestarwhaleVerified publisher0.6.151 of 4See more

starwhale starwhale 0.6.15

1 of the 4 container images this version deploys carry CVE-2025-59952.

Container imageDigestPackageFixed in
ghcr.io/star-whale/server:0.6.158368359c8dd0
minio@8.4.4
8.6.0

Open the chart page →

13,486
rundeckcloudnativeapp0.1.01 of 2See more

rundeck cloudnativeapp 0.1.0

1 of the 2 container images this version deploys carry CVE-2025-59952.

Container imageDigestPackageFixed in
rundeck/rundeck:3.0.16b13e8059ad72
minio@5.0.1
8.6.0

Open the chart page →

23,665
rundeckdwardu-helm-charts0.3.41 of 2See more

rundeck dwardu-helm-charts 0.3.4

1 of the 2 container images this version deploys carry CVE-2025-59952.

Container imageDigestPackageFixed in
rundeck/rundeck:3.2.74d64fe56f767
minio@6.0.10
8.6.0

Open the chart page →

19,802
mvfi4trustVerified publisher1.1.21 of 1See more

mvf i4trust 1.1.2

1 of the 1 container images this version deploys carry CVE-2025-59952.

Container imageDigestPackageFixed in
wistefan/mvf:lateste0887302b2d8
minio@8.4.5
8.6.0

Open the chart page →

7,144
vcwaltidi4trustVerified publisher0.0.191 of 1See more

vcwaltid i4trust 0.0.19

1 of the 1 container images this version deploys carry CVE-2025-59952.

Container imageDigestPackageFixed in
quay.io/fiware/waltid:1.14.1-SNAPSHOT93889c3d8a34
minio@8.4.6
8.6.0

Open the chart page →

7,862
tampkubebb5.6.01 of 2See more

tamp kubebb 5.6.0

1 of the 2 container images this version deploys carry CVE-2025-59952.

Container imageDigestPackageFixed in
kubebb/gateway-api:v5.6.04d062f20309c
minio@8.0.3
8.6.0

Open the chart page →

4,664
radar-gatewayradar-baseVerified publisher1.9.01 of 2See more

radar-gateway radar-base 1.9.0

1 of the 2 container images this version deploys carry CVE-2025-59952.

Container imageDigestPackageFixed in
ghcr.io/radar-base/radar-gateway/radar-gateway:0.9.4219d894aa7a6
minio@8.5.17
8.6.0

Open the chart page →

2,284
radar-outputradar-baseVerified publisher1.2.101 of 1See more

radar-output radar-base 1.2.10

1 of the 1 container images this version deploys carry CVE-2025-59952.

Container imageDigestPackageFixed in
ghcr.io/radar-base/radar-output-restructure/radar-output-restructure:3.0.67fb9c70e96a4
minio@8.5.17
8.6.0

Open the chart page →

2,465
reportportalreportportal5.7.23 of 8See more

reportportal reportportal 5.7.2

3 of the 8 container images this version deploys carry CVE-2025-59952.

Container imageDigestPackageFixed in
reportportal/service-api:5.7.29df41f8fb320
minio@6.0.13
8.6.0
reportportal/service-authorization:5.7.09e73114dbd15
minio@6.0.13
8.6.0
reportportal/service-jobs:5.7.2dc166c58485a
minio@6.0.13
8.6.0

Open the chart page →

25,737
rundecksvtech-public-helm-charts1.0.01 of 2See more

rundeck svtech-public-helm-charts 1.0.0

1 of the 2 container images this version deploys carry CVE-2025-59952.

Container imageDigestPackageFixed in
svtechnmaa/svtech_rundeck:v1.2.26e368ace0977
minio@7.1.0
8.6.0

Open the chart page →

18,756

Container images carrying it

16 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
glasskube/operator:0.12.2be5133100d63
minio@8.5.6
8.6.0
1
intelloop/atlas-cmms-backend:v1.5.14c61bc3dd3f8
minio@8.5.17
8.6.0
1
kubebb/gateway-api:v5.6.04d062f20309c
minio@8.0.3
8.6.0
1
reportportal/service-api:5.7.29df41f8fb320
minio@6.0.13
8.6.0
1
reportportal/service-authorization:5.7.09e73114dbd15
minio@6.0.13
8.6.0
1
reportportal/service-jobs:5.7.2dc166c58485a
minio@6.0.13
8.6.0
1
rundeck/rundeck:3.2.74d64fe56f767
minio@6.0.10
8.6.0
1
rundeck/rundeck:3.0.16b13e8059ad72
minio@5.0.1
8.6.0
1
svtechnmaa/svtech_rundeck:v1.2.26e368ace0977
minio@7.1.0
8.6.0
1
thmmniii/fbs-core:v1.27.15438517d9fc2
minio@8.5.4
8.6.0
1
treskon/portrait:DEV-latest88e813f22347
minio@8.5.8
8.6.0
1
wistefan/mvf:lateste0887302b2d8
minio@8.4.5
8.6.0
1
ghcr.io/radar-base/radar-gateway/radar-gateway:0.9.4219d894aa7a6
minio@8.5.17
8.6.0
1
ghcr.io/radar-base/radar-output-restructure/radar-output-restructure:3.0.67fb9c70e96a4
minio@8.5.17
8.6.0
1
ghcr.io/star-whale/server:0.6.158368359c8dd0
minio@8.4.4
8.6.0
1
quay.io/fiware/waltid:1.14.1-SNAPSHOT93889c3d8a34
minio@8.4.6
8.6.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.