SeaweedFS CVE-2026-77368

Exploitation requires all three of the following conditions to be simultaneously true: (1) the SeaweedFS filer must have JWT signing configured and active (filerGuard enabled); (2) TUS resumable uploads must be enabled on the filer (the /.tus route must be accessible); and (3) the deployment must use prefix-restricted JWT tokens - specifically tokens with non-empty AllowedPrefixes fields - for multi-tenancy isolation. Attackers must already hold a valid JWT token scoped to at least one allowed prefix; completely unauthenticated exploitation is not possible given PR:L in the CVSS vector. The practical limiting factor is obtaining a foreign tenant's TUS session ID, which is not cryptographically secret but also not trivially guessable without network visibility or shared infrastructure access. Deployments without JWT prefix scoping, without TUS enabled, or operating in single-tenant mode are completely unaffected regardless of SeaweedFS version.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L, score 7.6) accurately reflects the attack profile: network-accessible, low complexity, requiring only a low-privilege JWT token. The High integrity impact is well-justified - an attacker can write arbitrary content to filesystem paths that their token explicitly denies, completely defeating the multi-tenancy isolation model. The Low confidentiality impact reflects the ability to HEAD foreign sessions to read upload progress and size metadata. The Low availability impact captures the ability to DELETE other tenants' upload sessions mid-transfer. No EPSS score was provided in the input data and the vulnerability does not appear in CISA KEV, so no confirmed active exploitation exists at time of analysis. Real-world risk is significant specifically for multi-tenant SeaweedFS deployments that have both JWT prefix scoping and TUS uploads configured simultaneously - deployments missing either feature are entirely unaffected, which substantially narrows the exposed population. The AC:L rating is appropriate because no race condition or special timing is required; the only practical barrier is acquiring a foreign session ID, which is not cryptographically protected by the TUS protocol. The overall risk profile is moderate-to-high for affected configurations but the narrow prerequisites limit blast radius across the broader SeaweedFS install base.

An attacker authenticated with a JWT token scoped to /buckets/attacker/ observes a co-tenant's in-progress TUS upload session ID - obtainable via shared infrastructure logs, network interception, or insider knowledge - targeting /buckets/secret/sensitive.bin. The attacker sends PATCH requests to the victim's session ID using their own valid restricted token, injecting malicious content; upon TUS upload completion, the tampered file lands at /buckets/secret/sensitive.bin, a path the attacker's token forbids, fully bypassing the AllowedPrefixes isolation. No public exploit code has been identified at time of analysis, but the commit diff and test case in GHSA-99q7-x53r-6j4g provide a clear reproduction path.