CVE-2026-54917highCWE-22

CVE-2026-54917: falha de alta gravidade em seaweedfs

SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access

Publicada em

Seguir esta CVE+ Monitorar seaweedfs+ Monitorar github.com/seaweedfs/seaweedfs

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

56Vexday Risk Score

Corrija em breve. Ela tem exploit funcional público.

ssvc Attendcvss 7.8epss 1.6%
da publicação à arma41 dias
Publicada no NVD25 de jun.
1ª PoC+41d
SeaweedFS is a distributed storage system for object storage (S3), file systems, and Iceberg tables. Prior to 4.30, the S3 API gateway and the Iceberg REST catalog gateway construct their routers with mux.NewRouter().SkipClean(true). With path cleaning disabled, a .. segment inside the URL survives routing, so a request such as `GET /bucket-A/../evil-bucket/key`, is matched as bucket=bucket-A, object=../evil-bucket/key. The captured object key is then joined into a filer path with util.JoinPath (S3) / path.Join (Iceberg), which collapse the .. server-side, so the actual read or write lands in evil-bucket. This vulnerability is fixed in 4.30.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
Produtos afetados
seaweedfs · seaweedfs
⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — seaweedfs

No mesmo produto, das mais perigosas para as menos.

CVE-2026-58372HIGHSeaweedFS < 4.34 - Cross-Bucket Object Deletion via DeleteObjects Request-Body KeysEPSS 0.9%CVE-2026-72920CRITICALSeaweedFS: Unauthenticated filer IAM gRPC service grants S3 administrative controlEPSS 0.8%CVE-2026-55874HIGHSeaweedFS: Path traversal in the S3 gateway X-Amz-Copy-Source header allows cross-bucket object readEPSS 0.6%CVE-2026-73080CRITICALSeaweedFS: Unauthenticated SSRF with response read-back via VolumeServer.FetchAndWriteNeedleEPSS 0.5%CVE-2026-72921HIGHSeaweedFS: Filer JWT allowed_prefixes literal prefix match allows cross-tenant access to sibling pathsEPSS 0.4%CVE-2026-77298HIGHSeaweedFS S3 OIDC Bearer authentication bypasses IAM role trust policyEPSS 0.4%