| Reporter | Title | Published | Views | Family All 7 |
|---|---|---|---|---|
 | CVE-2026-77763 JuiceFS Local Filestore Backend Joins Object Keys onto the Storage Root Without a Containment Check, Allowing Writes Outside the Configured Directory | 21 Aug 202611:05 | – | cvelist |
 | EUVD-2026-63899 | 21 Aug 202611:05 | – | euvd |
 | CVE-2026-77763 | 21 Aug 202611:05 | – | mend |
 | CVE-2026-77763 | 21 Aug 202611:17 | – | nvd |
 | PT-2026-79360 | 21 Aug 202600:00 | – | ptsecurity |
 | CVE-2026-77763: Improper Limitation of a Pathname to a Restricted Directory | 21 Aug 202600:00 | – | rapid7 |
 | CVE-2026-77763 JuiceFS Local Filestore Backend Joins Object Keys onto the Storage Root Without a Containment Check, Allowing Writes Outside the Configured Directory | 21 Aug 202611:05 | – | vulnrichment |
[
{
"vendor": "juicedata",
"product": "juicefs",
"defaultStatus": "unaffected",
"repo": "https://github.com/juicedata/juicefs",
"collectionURL": "https://proxy.golang.org",
"packageName": "github.com/juicedata/juicefs",
"packageURL": "pkg:golang/github.com/juicedata/juicefs",
"versions": [
{
"version": "0",
"lessThanOrEqual": "1.4.1",
"status": "affected",
"versionType": "semver"
}
],
"programFiles": [
"pkg/object/file.go"
]
}
]| Parameter | Position | Path | Description | CWE |
|---|---|---|---|---|
| key | path | /Put | The Put operation consumes a key that can contain traversal segments (e.g., ../), allowing an attacker to write files outside the intended root directory. | CWE-22 |
| key | path | /Get | The Get operation consumes a key that can contain traversal segments, potentially allowing unauthorized access to files outside the intended root. | CWE-22 |
| key | path | /Head | The Head operation consumes a key that can contain traversal segments, potentially allowing unauthorized metadata access. | CWE-22 |
| key | path | /Delete | The Delete operation consumes a key that can contain traversal segments, allowing an attacker to delete files outside the intended root. | CWE-22 |
| key | path | /Chmod | The Chmod operation consumes a key that can contain traversal segments, allowing an attacker to modify permissions on files outside the intended root. | CWE-22 |
| key | path | /Chown | The Chown operation consumes a key that can contain traversal segments, allowing an attacker to modify ownership of files outside the intended root. | CWE-22 |
| key | path | /Symlink | The Symlink operation consumes a key that can contain traversal segments, allowing an attacker to create symbolic links outside the intended root. | CWE-22 |
| key | path | /Readlink | The Readlink operation consumes a key that can contain traversal segments, allowing an attacker to read symbolic link targets outside the intended root. | CWE-22 |
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
16 Oct 2026 15:10Current
5.9Medium risk
Vulners AI Score5.9
CVSS 3.16.5
CVSS 47.1
EPSS0.00498
SSVC