EUVD-2026-66767Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
SFTP is network-accessible (AV:N), valid credentials required (PR:L), naming-collision condition is environmental not complex (AC:L), and no availability impact is described.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
4DescriptionCVE.org
SeaweedFS is a distributed storage system for files and blobs. In versions from 3.88 through 4.39, the SFTP server evaluates configured path permissions with a literal string-prefix comparison, so a user scoped to a path is also granted the same access to any sibling path whose name merely begins with the same characters. A user granted access to /tenants/alice therefore also matches /tenants/alice-archive, /tenants/alice2, and similar siblings, because the check does not require a path-component boundary. An authenticated low-privilege SFTP user with a root home directory and narrow path permissions can thereby cross the configured ACL boundary to read another tenant's files, and to overwrite them if granted write, all through the documented SFTP service with its own valid credentials. This issue is fixed in version 4.40.
AnalysisAI
Incorrect path authorization in SeaweedFS SFTP server (versions 3.88-4.39) allows an authenticated low-privilege user to cross configured ACL boundaries and access or overwrite sibling tenants' files. The SFTP permission check used a bare string-prefix comparison, so a user scoped to /tenants/alice was also permitted access to any path beginning with those same characters - such as /tenants/alice-archive or /tenants/alice2 - without requiring a directory-component boundary. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Three conditions must all hold: (1) the SeaweedFS SFTP service must be running and network-accessible - this requires explicit operator configuration; (2) the attacker must possess a valid SFTP account with a path-scoped permission entry (e.g., /tenants/alice with read, write, or list permissions); (3) a sibling path must exist in the same parent directory whose name begins with the same characters as the attacker's permitted root (e.g., /tenants/alice-archive must exist as a real directory containing another tenant's data). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) accurately reflects the core risk: the attack is network-reachable, requires no elevated privileges beyond a valid SFTP account, involves no interaction from another party, and yields both full read and write access to peer-tenant data. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with a valid SFTP account scoped to /tenants/alice connects using a standard SFTP client and requests /tenants/alice-archive/secret.txt - because the ACL check evaluates strings.HasPrefix('/tenants/alice-archive/secret.txt', '/tenants/alice') as true, access is granted and the peer tenant's file contents are returned. If the attacker's account carries write permission, they can issue a file-create or overwrite operation against the sibling path through the same mechanism, corrupting or replacing another tenant's data without any credential theft or privilege escalation beyond their own valid account. |
| Remediation | Upgrade to SeaweedFS 4.40, which resolves the flaw by replacing the bare strings.HasPrefix call with a boundary-aware pathWithin() function; the fix is available at https://github.com/seaweedfs/seaweedfs/commit/29981f8d24a62e9571962c4534fb23c48c00bae2 and is detailed in advisory GHSA-fvpg-g364-j8vh. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all SeaweedFS deployments and identify instances running versions 3.88-4.39 in multi-tenant configurations; prioritize documentation of tenant data sensitivity and access scope. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Server-side request forgery with response read-back in SeaweedFS distributed storage (versions prior to 4.24) lets anyon
Cross-bucket read/write in SeaweedFS before 4.30 lets remote attackers escape a bucket's namespace because the S3 API ga
Cross-tenant object deletion in SeaweedFS before 4.34 lets an authenticated S3 principal holding write access to just on
Authentication bypass in SeaweedFS filer before 4.24 exposes the SeaweedIdentityAccessManagement gRPC service without an
Authorization bypass in SeaweedFS versions 4.39 and earlier allows authenticated federated users to assume IAM roles the
Cross-tenant authorization bypass in SeaweedFS filer JWT path authorization allows any authenticated tenant to read and
SeaweedFS 4.39's TUS resumable-upload handler fails to re-validate JWT prefix scoping on HEAD, PATCH, and DELETE operati
Incorrect authorization in SeaweedFS S3 API's PutObjectAcl handler allows an authenticated low-privilege S3 principal to
Unvalidated JSONP callback reflection in SeaweedFS before 4.30 enables cross-origin reads of cluster topology, volume se
seaweedfs v3.68 was discovered to contain a SQL injection vulnerability via the component /abstract_sql/abstract_sql_sto
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today