| Reporter | Title | Published | Views | Family All 7 |
|---|---|---|---|---|
 | CVE-2026-77763 JuiceFS Local Filestore Backend Joins Object Keys onto the Storage Root Without a Containment Check, Allowing Writes Outside the Configured Directory | 21 Aug 202611:05 | – | cvelist |
 | EUVD-2026-63899 | 21 Aug 202611:05 | – | euvd |
 | CVE-2026-77763 | 21 Aug 202611:05 | – | mend |
 | CVE-2026-77763 | 21 Aug 202611:17 | – | nvd |
 | PT-2026-79360 | 21 Aug 202600:00 | – | ptsecurity |
 | CVE-2026-77763: Improper Limitation of a Pathname to a Restricted Directory | 21 Aug 202600:00 | – | rapid7 |
 | CVE-2026-77763 JuiceFS Local Filestore Backend Joins Object Keys onto the Storage Root Without a Containment Check, Allowing Writes Outside the Configured Directory | 21 Aug 202611:05 | – | vulnrichment |
[
{
"vendor": "juicedata",
"product": "juicefs",
"defaultStatus": "unaffected",
"repo": "https://github.com/juicedata/juicefs",
"collectionURL": "https://proxy.golang.org",
"packageName": "github.com/juicedata/juicefs",
"packageURL": "pkg:golang/github.com/juicedata/juicefs",
"versions": [
{
"version": "0",
"lessThanOrEqual": "1.4.1",
"status": "affected",
"versionType": "semver"
}
],
"programFiles": [
"pkg/object/file.go"
]
}
]| Parameter | Position | Path | Description | CWE |
|---|---|---|---|---|
| key | request body | Put | The Put operation consumes a key that can contain traversal segments, allowing an attacker to write content to a path outside the intended local destination. | CWE-22 |
| key | request body | Get | The Get operation consumes a key that can contain traversal segments, allowing an attacker to access files outside the intended local destination. | CWE-22 |
| key | request body | Head | The Head operation consumes a key that can contain traversal segments, allowing an attacker to access file metadata outside the intended local destination. | CWE-22 |
| key | request body | Delete | The Delete operation consumes a key that can contain traversal segments, allowing an attacker to delete files outside the intended local destination. | CWE-22 |
| key | request body | Chmod | The Chmod operation consumes a key that can contain traversal segments, allowing an attacker to modify permissions of files outside the intended local destination. | CWE-22 |
| key | request body | Chown | The Chown operation consumes a key that can contain traversal segments, allowing an attacker to modify ownership of files outside the intended local destination. | CWE-22 |
| key | request body | Symlink | The Symlink operation consumes a key that can contain traversal segments, allowing an attacker to create symbolic links outside the intended local destination. | CWE-22 |
| key | request body | Readlink | The Readlink operation consumes a key that can contain traversal segments, allowing an attacker to read symbolic links outside the intended local destination. | CWE-22 |
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
08 Nov 2026 14:08Current
5.9Medium risk
Vulners AI Score5.9
CVSS 3.16.5
CVSS 47.1
EPSS0.00498
SSVC