PT-2026-55079

SeaweedFS is a distributed storage system for object storage S3, file systems, and Iceberg tables. Prior to 4.30, the S3 API gateway and the Iceberg REST catalog gateway construct their routers with mux.NewRouter.SkipCleantrue. With path cleaning disabled, a .. segment inside the URL survives...

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass via the router process in the S3 and Iceberg REST gateways when path cleaning is disabled. An attacker can gain unauthorized access to resources in other buckets by crafting requests containing .. segments in the...

CVE-2026-54917

SeaweedFS is a distributed storage system for object storage S3, file systems, and Iceberg tables. Prior to 4.30, the S3 API gateway and the Iceberg REST catalog gateway construct their routers with mux.NewRouter.SkipCleantrue. With path cleaning disabled, a .. segment inside the URL survives...

CVE-2026-54917 SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access

SeaweedFS is a distributed storage system for object storage S3, file systems, and Iceberg tables. Prior to 4.30, the S3 API gateway and the Iceberg REST catalog gateway construct their routers with mux.NewRouter.SkipCleantrue. With path cleaning disabled, a .. segment inside the URL survives...

CVE-2026-54917

SeaweedFS is a distributed storage system for object storage S3, file systems, and Iceberg tables. Prior to 4.30, the S3 API gateway and the Iceberg REST catalog gateway construct their routers with mux.NewRouter.SkipCleantrue. With path cleaning disabled, a .. segment inside the URL survives...

CVE-2026-54917 SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access

SeaweedFS is a distributed storage system for object storage S3, file systems, and Iceberg tables. Prior to 4.30, the S3 API gateway and the Iceberg REST catalog gateway construct their routers with mux.NewRouter.SkipCleantrue. With path cleaning disabled, a .. segment inside the URL survives...

CVE-2026-54917 SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access

SeaweedFS is a distributed storage system for object storage S3, file systems, and Iceberg tables. Prior to 4.30, the S3 API gateway and the Iceberg REST catalog gateway construct their routers with mux.NewRouter.SkipCleantrue. With path cleaning disabled, a .. segment inside the URL survives...

CVE-2026-54917

CVE-2026-54917 affects SeaweedFS prior to 4.30. The S3 gateway and Iceberg REST catalog gateway construct routers with mux.NewRouter().SkipClean(true); when path cleaning is disabled, a .. segment in URLs can survive routing (example: GET /bucket-A/../evil-bucket/key) and be parsed as a valid buc...

CVE-2026-54917: Improper Limitation of a Pathname to a Restricted Directory

SeaweedFS is a distributed storage system for object storage S3, file systems, and Iceberg tables. Prior to 4.30, the S3 API gateway and the Iceberg REST catalog gateway construct their routers with mux.NewRouter.SkipCleantrue. With path cleaning disabled, a .. segment inside the URL survives...

CVE-2026-42812

In Apache Iceberg, the table's metadata files are control files: they tell readers which data files belong to the table and which table version to read. write.metadata.path is an optional table property that tells Polaris where to write those metadata files. For a table already registered in a...

CVE-2026-42810

Apache Polaris accepts literal characters in namespace and table names. When it later builds temporary S3 access policies for delegated table access, those same characters appear to be reused unescaped in S3 IAM resource patterns and s3:prefix conditions. In S3 IAM policy matching, is treated as ...

PT-2026-52557

Name of the Vulnerable Software and Affected Versions SeaweedFS versions prior to 4.30 Description The S3 API gateway and the Iceberg REST catalog gateway use a router configuration that disables path cleaning. This allows a .. segment within a URL to persist during routing. For example, a reques...

Malicious Package

Overview iceberg-javascript is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in iceberg-javascript (npm)

Three malicious npm packages published by the superbase account implement a dual-vector supply chain attack. Each package bundles a 4.5 MB statically-linked, UPX-packed ELF binary at .claude/settings and a companion .claude/settings.json that registers the binary as a Claude Code SessionStart hoo...

MAL-2026-3649 Malicious code in iceberg-javascript (npm)

Three malicious npm packages published by the superbase account implement a dual-vector supply chain attack. Each package bundles a 4.5 MB statically-linked, UPX-packed ELF binary at .claude/settings and a companion .claude/settings.json that registers the binary as a Claude Code SessionStart hoo...

iceberg-rivers-search (0.1.0), raster2tiles (>=0.0.3, <=0.1.0) potentially affected by CVE-2026-8212 via gdal (2.2.1)

gdal PYPI version 2.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on gdal and may be impacted: - iceberg-rivers-search 0.1.0 - raster2tiles =0.0.3, =0.1.0 Source cves: CVE-2026-8212 Source advisory: OSV:GHSA-R5M4-5VWW-W9F5...

iceberg-rivers-search (0.1.0), raster2tiles (>=0.0.3, <=0.1.0) potentially affected by CVE-2026-8213 via gdal (2.2.1)

gdal PYPI version 2.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on gdal and may be impacted: - iceberg-rivers-search 0.1.0 - raster2tiles =0.0.3, =0.1.0 Source cves: CVE-2026-8213 Source advisory: OSV:PYSEC-2026-2157...

iceberg-rivers-search (0.1.0), raster2tiles (>=0.0.3, <=0.1.0) potentially affected by CVE-2026-8088 via gdal (2.2.1)

gdal PYPI version 2.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on gdal and may be impacted: - iceberg-rivers-search 0.1.0 - raster2tiles =0.0.3, =0.1.0 Source cves: CVE-2026-8088 Source advisory: OSV:GHSA-J3F5-RW74-G4RV...

iceberg-rivers-search (0.1.0), raster2tiles (>=0.0.3, <=0.1.0) potentially affected by CVE-2026-8087 via gdal (2.2.1)

gdal PYPI version 2.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on gdal and may be impacted: - iceberg-rivers-search 0.1.0 - raster2tiles =0.0.3, =0.1.0 Source cves: CVE-2026-8087 Source advisory: OSV:GHSA-H9RH-5FFH-H669...

iceberg-rivers-search (0.1.0), raster2tiles (>=0.0.3, <=0.1.0) potentially affected by CVE-2026-8088 via gdal (2.2.1)

gdal PYPI version 2.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on gdal and may be impacted: - iceberg-rivers-search 0.1.0 - raster2tiles =0.0.3, =0.1.0 Source cves: CVE-2026-8088 Source advisory: OSV:PYSEC-2026-2156...