SeaweedFS EUVD-2026-56159

Exploitation requires the attacker to hold a valid SeaweedFS filer JWT token that is scoped to at least one path prefix (i.e., the attacker is an authenticated but lower-privileged tenant in the system). The deployment must use SeaweedFS's JWT path-prefix authorization feature with multiple tenants whose assigned path prefixes share a common string prefix - for example, /tenant1 and /tenant1234 co-existing in the same filer. Exploitation is bounded to filer read and write operations within the reachable sibling namespaces; it does not affect the SeaweedFS master server, volume servers, or cluster integrity. Deployments using a single tenant, root-scoped tokens, or no JWT authorization at all are not affected. The absence of path-component normalization also permitted ../ traversal within scoped tokens prior to the fix, representing an additional exploitation condition for path-escaped access.

The NVD CVSS 8.1 score accurately reflects the risk profile: AV:N/AC:L/PR:L/UI:N means any network-reachable holder of a low-privilege scoped JWT can exploit this with no setup friction, and C:H/I:H means both cross-tenant reads and writes are achievable. The real-world risk is directly proportional to the deployment's use of path-scoped multi-tenancy - single-tenant or root-token deployments are entirely unaffected. No EPSS score was provided in the intelligence, and the vulnerability is not listed in CISA KEV, indicating no confirmed mass exploitation at time of analysis. However, the flaw is trivially exploitable once the bypass pattern is known, and the mechanism is now publicly documented in the fix's test cases. The secondary risk of path traversal (../ segments bypassing subtree restrictions) was also fixed by the same change, suggesting the pre-4.24 authorization surface was broader than the primary finding alone. No conflicting signals between CVSS and description exist - the network vector and low-privilege requirement are internally consistent.

A tenant who has been issued a filer JWT scoped to /acme sends a GET request to the SeaweedFS filer API targeting /acmecorp/contracts/nda.pdf. The filer's pre-4.24 authorization check calls strings.HasPrefix("/acmecorp/contracts/nda.pdf", "/acme"), which returns true, and the response returns a competitor tenant's confidential document. The same token can issue a PUT request to overwrite or corrupt data in the /acmecorp subtree. No exploit tooling is required beyond a standard HTTP client and a legitimately issued JWT.