What is the CVSS score of CVE-2026-55874?

CVE-2026-55874 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of SeaweedFS are affected by CVE-2026-55874?

SeaweedFS S3 API gateway versions prior to 4.34 allow authenticated users to bypass bucket-level access controls and read objects from unauthorized buckets through path traversal in the CopyObject…. A patch is available.

Is there a public PoC exploit available for CVE-2026-55874?

Yes, a public proof-of-concept exploit is available for CVE-2026-55874. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2026-55874?

Within 24 hours: inventory all SeaweedFS deployments and identify instances running versions prior to 4.34. Within 7 days: apply vendor-released patch by upgrading to SeaweedFS 4.34 or later. Within 30 days: complete vulnerability remediation across all production and non-production environments; review S3 access logs from affected versions for unauthorized cross-bucket requests.

SeaweedFS CVE-2026-55874

EUVD-2026-42285 HIGH

Path Traversal (CWE-22)

2026-07-08 security-advisories@github.com

GHSA-56wq-x3wv-3ff4

Path Traversal Red Hat Suse

7.7

CVSS 3.1 · Vendor: github

Severity by source

Vendor (github) PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

7.7 HIGH

Network-reachable S3 API, low complexity, requires a valid bucket-scoped identity (PR:L); scope changes as the caller crosses its authorization boundary, yielding high confidentiality only with no integrity or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

7.7 HIGH

qualitative

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jul 08, 2026 - 16:01 EUVD

Analysis Generated

Jul 08, 2026 - 15:40 vuln.today

DescriptionCVE.org

SeaweedFS is a distributed storage system. Prior to 4.34, the S3 API gateway does not reject dot-dot path segments in the X-Amz-Copy-Source header used by CopyObject and UploadPartCopy, allowing an authenticated identity scoped to one bucket to read objects from other buckets through server-side copy. This issue is fixed in version 4.34.

AnalysisAI

Cross-bucket object disclosure in SeaweedFS S3 API gateway (versions prior to 4.34) allows an authenticated identity scoped to a single bucket to read objects from other buckets by injecting dot-dot (../) path segments into the X-Amz-Copy-Source header of CopyObject and UploadPartCopy requests. Because the gateway performs a server-side copy without normalizing or rejecting traversal segments, the bucket-level access boundary is bypassed. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but the fix in 4.34 is confirmed via the vendor security advisory and source commit.

Technical ContextAI

SeaweedFS is a distributed object/blob storage system that exposes an Amazon S3-compatible API gateway for interoperability with S3 clients and SDKs. The vulnerability is a classic CWE-22 Path Traversal ('..' relative path escape) manifesting in the application layer rather than the filesystem: the S3 CopyObject and UploadPartCopy operations use the X-Amz-Copy-Source request header to identify the source object, formatted as 'bucket/key'. Prior to 4.34 the gateway failed to canonicalize or reject dot-dot segments in this header, so a value crafted with '../' could resolve outside the caller's authorized bucket namespace and reference objects in sibling buckets. The root cause is missing input validation/normalization on a security-relevant identifier that is subsequently used for an authorization-sensitive server-side copy. No CPE strings were provided in the intelligence, so exact affected package identifiers are drawn from the vendor repository (github.com/seaweedfs/seaweedfs) and release tagging rather than NVD CPE data.

RemediationAI

Vendor-released patch: SeaweedFS 4.34 - upgrade the S3 gateway and associated components to 4.34 or later (https://github.com/seaweedfs/seaweedfs/releases/tag/4.34), which rejects dot-dot path segments in the X-Amz-Copy-Source header; the underlying fix is in pull request https://github.com/seaweedfs/seaweedfs/pull/9929 and commit b44cf51fe931bd75aa4d37ae766bea90d7f85ccd. If an immediate upgrade is not possible, compensating controls include placing a reverse proxy or WAF in front of the S3 gateway to inspect and reject any X-Amz-Copy-Source header value containing '..' or encoded traversal sequences (trade-off: may break legitimate keys that contain '..' substrings and adds a proxy hop), and tightening identity scoping so credentials that only need single-bucket access cannot be leveraged broadly - though note that scoping alone does not stop this bug, since the vulnerability is the gateway ignoring that scope during copy-source resolution. Rotate and audit any S3 identities and review access logs for anomalous CopyObject/UploadPartCopy requests referencing cross-bucket sources. Full details are in the vendor advisory https://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-56wq-x3wv-3ff4.