SeaweedFS CVE-2026-77317

Three conditions must all hold: (1) the SeaweedFS SFTP service must be running and network-accessible - this requires explicit operator configuration; (2) the attacker must possess a valid SFTP account with a path-scoped permission entry (e.g., /tenants/alice with read, write, or list permissions); (3) a sibling path must exist in the same parent directory whose name begins with the same characters as the attacker's permitted root (e.g., /tenants/alice-archive must exist as a real directory containing another tenant's data). Exploitation is strictly limited to authenticated users - unauthenticated access to the SFTP endpoint is not implied. The naming collision between tenant paths is the key structural prerequisite: if no sibling path shares the string prefix, the vulnerability has no practical effect in that environment. The home directory check shares the same flaw, but the primary exploitation path is through the explicit per-path permission entries, which are the documented multi-tenancy mechanism.

The CVSS 3.1 score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) accurately reflects the core risk: the attack is network-reachable, requires no elevated privileges beyond a valid SFTP account, involves no interaction from another party, and yields both full read and write access to peer-tenant data. Real-world risk is strongly deployment-dependent - it is high in multi-tenant SeaweedFS environments where SFTP is the access layer and multiple tenants share a parent directory, and near-zero in single-tenant or fully trusted deployments. EPSS data is absent from available intelligence sources, so exploitation probability cannot be quantified. The CVE is not in CISA KEV at time of analysis, and no standalone weaponized POC has been identified. However, the public security advisory and fix commit together provide a complete description of the vulnerable code path, meaning any authenticated user who reads the advisory can construct an exploit with minimal effort. The naming-collision precondition (a sibling path must exist) is a genuine limiting factor, but in real multi-tenant deployments this condition is routinely met by operational naming conventions.

An attacker with a valid SFTP account scoped to /tenants/alice connects using a standard SFTP client and requests /tenants/alice-archive/secret.txt - because the ACL check evaluates strings.HasPrefix('/tenants/alice-archive/secret.txt', '/tenants/alice') as true, access is granted and the peer tenant's file contents are returned. If the attacker's account carries write permission, they can issue a file-create or overwrite operation against the sibling path through the same mechanism, corrupting or replacing another tenant's data without any credential theft or privilege escalation beyond their own valid account.