CVE-2023-33955: Minio console object names with RIGHT-TO-LEFT OVERRIDE unicode character can be exploited
Summary
CVE-2023-33955: Minio console object names with RIGHT-TO-LEFT OVERRIDE unicode character can be exploited. Affects github.com/minio/console versions < 0.28.0. Fixed in 0.28.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Minio console is a Go package that provides a web-based user interface for managing Minio servers. It allows users to perform various operations such as browsing, uploading, and deleting objects stored in Minio. The package is vulnerable to a Unicode RIGHT-TO-LEFT OVERRIDE (RTLO) character exploit, which can be used to mask the original filename.
Vulnerability Detail
The vulnerability in Minio console arises from the ability to use Unicode RIGHT-TO-LEFT OVERRIDE characters to manipulate filenames. By inserting these characters, an attacker can obfuscate the true name of an object, potentially leading to confusion or misinterpretation by users or systems that rely on the displayed filename. This could result in unintended actions or security breaches.
How To Fix
Latest published version: v1.7.6 as of 23 Oct 2026
go get github.com/minio/console@v1.7.6Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.28.0
This is the first release that contains the fix.
go get github.com/minio/console@v0.28.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the package is not immediately feasible, a workaround is to manually remove any files with filenames containing RIGHT-TO-LEFT OVERRIDE characters and rewrite them properly with the correct file name and extension. It is important to avoid using RTLO characters in filenames to prevent potential exploitation.
Conclusion
The Minio console package is vulnerable to an exploit involving RIGHT-TO-LEFT OVERRIDE unicode characters in filenames. To mitigate this vulnerability, it is crucial to update the package to version 0.28.0 or later. Alternatively, affected files should be manually corrected to remove the exploit. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/minio/console →
FAQ
Minio console is a Go package that provides a web-based user interface for managing Minio servers. It allows users to perform various operations such as browsing, uploading, and deleting objects stored in Minio.
The vulnerability arises from the ability to use Unicode RIGHT-TO-LEFT OVERRIDE characters to manipulate filenames, which can obfuscate the true name of an object.
The vulnerability can lead to confusion or misinterpretation of filenames, potentially resulting in unintended actions or security breaches.
To fix the vulnerability, update the Minio console package to version 0.28.0 or later, which includes a patch that replaces the RIGHT-TO-LEFT OVERRIDE unicode character.
If immediate package update is not possible, manually remove files with filenames containing RIGHT-TO-LEFT OVERRIDE characters and rewrite them properly with the correct file name and extension.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/minio/console.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
