CVE-2026-54917

SeaweedFS prior to version 4.30 exposes a path traversal flaw in the S3 gateway and the Iceberg REST catalog gateway. Both gateways constructed their routers with mux.NewRouter().SkipClean(true), so with path cleaning disabled a .. segment in a URL like GET /bucket-A/../evil-bucket/key can surviv...