GO-2026-6361 SeaweedFS: Filer JWT allowed_prefixes literal prefix match allows cross-tenant access to sibling paths in github.com/seaweedfs/seaweedfs

SeaweedFS: Filer JWT allowedprefixes literal prefix match allows cross-tenant access to sibling paths in github.com/seaweedfs/seaweedfs...

GO-2026-6351 SeaweedFS: Unauthenticated filer IAM gRPC service grants S3 administrative control in github.com/seaweedfs/seaweedfs

SeaweedFS: Unauthenticated filer IAM gRPC service grants S3 administrative control in github.com/seaweedfs/seaweedfs...

Improper Authentication

github.com/seaweedfs/seaweedfs is vulnerable to improper authentication. The vulnerability is due to the filer registering the SeaweedIdentityAccessManagement gRPC service without mandatory authentication when jwt.filersigning.key is unset, which allows an attacker who can reach the filer gRPC po...

EUVD-2026-56159

SeaweedFS: Filer JWT allowedprefixes literal prefix match allows cross-tenant access to sibling paths...

GHSA-2V6V-25FM-P4FG SeaweedFS: Unauthenticated filer IAM gRPC service grants S3 administrative control

Impact The filer registered the IAM gRPC service SeaweedIdentityAccessManagement with no authentication. Any client able to reach the filer gRPC port could invoke IAM RPCs — CreateUser, CreateAccessKey, PutUserPolicy, and related calls — to mint credentials and grant itself S3 administrative...

CVE-2026-77368 SeaweedFS: Authenticated Cross-Prefix IDOR in Filer TUS Handler Enables Arbitrary Write to Tenant-Forbidden Paths

SeaweedFS is a distributed storage system for files and blobs. In version 4.39, the filer's TUS resumable-upload handler checks JWT allowedprefixes scoping only when a session is created, letting a low-privilege tenant hijack another tenant's upload session to write content to filer paths their o...

CVE-2026-77368 SeaweedFS: Authenticated Cross-Prefix IDOR in Filer TUS Handler Enables Arbitrary Write to Tenant-Forbidden Paths

SeaweedFS is a distributed storage system for files and blobs. In version 4.39, the filer's TUS resumable-upload handler checks JWT allowedprefixes scoping only when a session is created, letting a low-privilege tenant hijack another tenant's upload session to write content to filer paths their o...

CVE-2026-77368 SeaweedFS: Authenticated Cross-Prefix IDOR in Filer TUS Handler Enables Arbitrary Write to Tenant-Forbidden Paths

SeaweedFS is a distributed storage system for files and blobs. In version 4.39, the filer's TUS resumable-upload handler checks JWT allowedprefixes scoping only when a session is created, letting a low-privilege tenant hijack another tenant's upload session to write content to filer paths their o...

CVE-2026-77368

SeaweedFS version 4.39 contains an authenticated cross-prefix IDOR in the filer's TUS resumable-upload handler . The JWT allowed_prefixes scoping is enforced only when an upload session is created; the HEAD , PATCH , and DELETE verbs that operate on an existing session by its identifier never re-...

CVE-2026-77368: Authorization Bypass Through User-Controlled Key

SeaweedFS is a distributed storage system for files and blobs. In version 4.39, the filer's TUS resumable-upload handler checks JWT allowedprefixes scoping only when a session is created, letting a low-privilege tenant hijack another tenant's upload session to write content to filer paths their o...

BIT-SEAWEEDFS-2026-72921 SeaweedFS: Filer JWT allowed_prefixes literal prefix match allows cross-tenant access to sibling paths

SeaweedFS is a distributed storage system. Prior to 4.24, the weed/server/filerserverhandlers.go allowedprefixes authorization check used strings.HasPrefix on raw path strings, so a filer JWT scoped to /tenant1 also authorized sibling paths such as /tenant1234, /tenant1-old, and /tenant1backup,...

PT-2026-73436

SeaweedFS is a distributed storage system. Prior to 4.24, the weed/server/filer server handlers.go allowed prefixes authorization check used strings.HasPrefix on raw path strings, so a filer JWT scoped to /tenant1 also authorized sibling paths such as /tenant1234, /tenant1-old, and /tenant1backup...

CVE-2026-72921

SeaweedFS is a distributed storage system. Prior to 4.24, the weed/server/filerserverhandlers.go allowedprefixes authorization check used strings.HasPrefix on raw path strings, so a filer JWT scoped to /tenant1 also authorized sibling paths such as /tenant1234, /tenant1-old, and /tenant1backup,...

CVE-2026-72921

SeaweedFS CVE-2026-72921 affects the filer server component where the authorization check used strings.HasPrefix on raw path strings, allowing a JWT scoped to /tenant1 to access sibling paths like /tenant1234, /tenant1-old, and /tenant1backup. Root cause: prefix-based path matching without proper...

CVE-2026-72921 SeaweedFS: Filer JWT allowed_prefixes literal prefix match allows cross-tenant access to sibling paths

SeaweedFS is a distributed storage system. Prior to 4.24, the weed/server/filerserverhandlers.go allowedprefixes authorization check used strings.HasPrefix on raw path strings, so a filer JWT scoped to /tenant1 also authorized sibling paths such as /tenant1234, /tenant1-old, and /tenant1backup,...

OKIOK S-Filer Portal Login Panel - Detect

OKIOK S-Filer Portal login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """OKIOK S-Filer Portal login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'OKIOK S-Filer Portal Login...

SeaweedFS Filer - Unauthenticated Access Detection

SeaweedFS Filer interface is exposed without authentication.Unauthenticated users may be able to upload, modify, or access files, potentially leading to malicious file hosting, data exposure, or remote compromise. !/usr/bin/env python3 -- coding: utf-8 -- """SeaweedFS Filer interface is exposed...

PYSEC-2026-1298 Django Filer Unrestricted Upload of File with Dangerous Type

Unrestricted Upload of File with Dangerous Type, Improper Input Validation, Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in django CMS Association django Filer allows Input Data Manipulation, Stored XSS.This issue affects django Filer: from 3 before 3....

Django Filer Unrestricted Upload of File with Dangerous Type

Unrestricted Upload of File with Dangerous Type, Improper Input Validation, Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in django CMS Association django Filer allows Input Data Manipulation, Stored XSS.This issue affects django Filer: from 3 before 3....

CVE-2026-58371 SeaweedFS < 4.30 - Cross-Origin Information Disclosure via Unvalidated JSONP callback Parameter

SeaweedFS before 4.30 reflects the callback query parameter verbatim into responses served with Content-Type application/javascript in the shared writeJson helper weed/server/common.go, with no callback-name validation, no X-Content-Type-Options: nosniff header, and no CORS allow-list. Every JSON...