EUVD-2026-39535
GHSA-w62w-66v9-vvgv
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable gateway with low-complexity '..' payload; PR:L reflects that S3/Iceberg requests are normally authenticated, and cross-bucket read/write gives high C and I with no availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
SeaweedFS is a distributed storage system for object storage (S3), file systems, and Iceberg tables. Prior to 4.30, the S3 API gateway and the Iceberg REST catalog gateway construct their routers with mux.NewRouter().SkipClean(true). With path cleaning disabled, a .. segment inside the URL survives routing, so a request such as GET /bucket-A/../evil-bucket/key, is matched as bucket=bucket-A, object=../evil-bucket/key. The captured object key is then joined into a filer path with util.JoinPath (S3) / path.Join (Iceberg), which collapse the .. server-side, so the actual read or write lands in evil-bucket. This vulnerability is fixed in 4.30.
AnalysisAI
Cross-bucket read/write in SeaweedFS before 4.30 lets remote attackers escape a bucket's namespace because the S3 API gateway and the Iceberg REST catalog gateway build their gorilla/mux routers with SkipClean(true), letting a literal '..' segment survive routing before downstream path joins collapse it server-side. A request like 'GET /bucket-A/../evil-bucket/key' is routed as bucket=bucket-A but resolves to evil-bucket, allowing an actor to read or write objects in buckets they should not reach. There is no public exploit identified at time of analysis; the issue is fixed in 4.30 via PR #9687.
Technical ContextAI
SeaweedFS is a distributed object/file storage system exposing an S3-compatible API and an Iceberg REST catalog. The flaw is a classic CWE-22 path traversal rooted in a routing/normalization mismatch: gorilla/mux is configured with SkipClean(true), which intentionally disables the router's path cleaning so that '..' and '.' segments are NOT collapsed before route matching. The router therefore captures an object key (or Iceberg prefix/namespace/table mux vars) that still contains '..'. When that captured value is later joined into a filer path with util.JoinPath (S3) or path.Join (Iceberg), Go's path normalization collapses the '..' on the server side, so the effective filer location moves up and out of the intended bucket directory. The CPE cpe:2.3:a:seaweedfs:seaweedfs:*:*:*:*:*:*:*:* confirms the affected component is the SeaweedFS application itself across all versions prior to the fix. The 4.30 fix adds a validateRequestPath middleware and an isValidNameSegment helper that reject '.', '..', embedded slash/backslash, NUL, and empty/unit-separator-malformed segments before the inner handler runs.
RemediationAI
Vendor-released patch: upgrade SeaweedFS to 4.30 or later, which adds router-level path validation that rejects '..', '.', embedded slashes/backslashes, NUL, and malformed unit-separator namespace segments before they reach the filer path joins (per PR https://github.com/seaweedfs/seaweedfs/pull/9687 and advisory https://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-w62w-66v9-vvgv). If you cannot upgrade immediately, place a reverse proxy or WAF in front of the S3 and Iceberg gateway endpoints that normalizes and rejects request paths containing raw '..', '.', or encoded unit-separator (0x1F) sequences before they hit SeaweedFS - note this can break legitimate keys that contain dot segments and adds a normalization layer to maintain. Additionally, restrict network exposure of the S3 and Iceberg REST gateways to trusted clients and enforce per-bucket authentication/authorization so a single compromised credential cannot freely traverse, accepting that this limits but does not eliminate the traversal path. Avoid running these gateways with anonymous access enabled until patched.
Server-side request forgery with response read-back in SeaweedFS distributed storage (versions prior to 4.24) lets anyon
Cross-tenant authorization bypass in SeaweedFS filer JWT path authorization allows any authenticated tenant to read and
Cross-tenant object deletion in SeaweedFS before 4.34 lets an authenticated S3 principal holding write access to just on
Authentication bypass in SeaweedFS filer before 4.24 exposes the SeaweedIdentityAccessManagement gRPC service without an
Authorization bypass in SeaweedFS versions 4.39 and earlier allows authenticated federated users to assume IAM roles the
Incorrect path authorization in SeaweedFS SFTP server (versions 3.88-4.39) allows an authenticated low-privilege user to
SeaweedFS 4.39's TUS resumable-upload handler fails to re-validate JWT prefix scoping on HEAD, PATCH, and DELETE operati
Incorrect authorization in SeaweedFS S3 API's PutObjectAcl handler allows an authenticated low-privilege S3 principal to
Unvalidated JSONP callback reflection in SeaweedFS before 4.30 enables cross-origin reads of cluster topology, volume se
seaweedfs v3.68 was discovered to contain a SQL injection vulnerability via the component /abstract_sql/abstract_sql_sto
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today