CVEvulnerability
CVE-2026-55874
7.7 HIGH
Official page ↗
- Status
- Deferred
- Published
- 2026-07-08
- Last modified
- 2026-07-08
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.7 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
- Weaknesses
- CWE-22
Description
SeaweedFS is a distributed storage system. Prior to 4.34, the S3 API gateway does not reject dot-dot path segments in the X-Amz-Copy-Source header used by CopyObject and UploadPartCopy, allowing an authenticated identity scoped to one bucket to read objects from other buckets through server-side copy. This issue is fixed in version 4.34.
Related
Weakness · CWE (1)
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
References
- https://github.com/seaweedfs/seaweedfs/commit/b44cf51fe931bd75aa4d37ae766bea90d7f85ccd github.com
- https://github.com/seaweedfs/seaweedfs/pull/9929 github.com
- https://github.com/seaweedfs/seaweedfs/releases/tag/4.34 github.com
- https://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-56wq-x3wv-3ff4 github.com