CVE-2026-54917-SeaweedFS-Cross-Bucket-Traversal

CVE-2026-54917 — SeaweedFS S3 gateway cross-bucket path traversal Proof-of-concept and technical write-up for CVE-2026-54917 , a path-traversal in the SeaweedFS S3 API gateway that lets a caller reach objects in any bucket , regardless of what its credentials are authorized for. | ---|--- CVE|...

Virtuozzo Infrastructure 7.4 Hotfix 3 (7.4.0-97)

This update provides stability fixes. Vulnerability id: VSTOR-57933 The default gateway over a VLAN could be lost when a bond interface was brought up. Vulnerability id: VSTOR-99864 Restarting the management panel could leave background tasks stuck because their locks were cleared while the task...

PT-2026-99024

SeaweedFS before 4.34 contains a path traversal vulnerability in the S3 gateway DeleteMultipleObjectsHandler that allows authenticated S3 principals with write access to a single bucket to delete arbitrary objects in other tenants' buckets by supplying object keys containing ../ sequences in the...

SUSE CVE-2026-54917

SeaweedFS is a distributed storage system for object storage S3, file systems, and Iceberg tables. Prior to 4.30, the S3 API gateway and the Iceberg REST catalog gateway construct their routers with mux.NewRouter.SkipCleantrue. With path cleaning disabled, a .. segment inside the URL survives...

GO-2026-6327 SeaweedFS: Path traversal in the S3 gateway X-Amz-Copy-Source header allows cross-bucket object read in github.com/seaweedfs/seaweedfs

SeaweedFS: Path traversal in the S3 gateway X-Amz-Copy-Source header allows cross-bucket object read in github.com/seaweedfs/seaweedfs...

GHSA-56WQ-X3WV-3FF4 SeaweedFS: Path traversal in the S3 gateway X-Amz-Copy-Source header allows cross-bucket object read

Summary The SeaweedFS S3 API gateway did not reject .. path segments in the X-Amz-Copy-Source header used by CopyObject and UploadPartCopy. The request URL path was hardened against traversal in 4.30 CVE-2026-54917, but the copy-source header was only checked for emptiness, so a .. segment in the...

SeaweedFS: Path traversal in the S3 gateway X-Amz-Copy-Source header allows cross-bucket object read

Summary The SeaweedFS S3 API gateway did not reject .. path segments in the X-Amz-Copy-Source header used by CopyObject and UploadPartCopy. The request URL path was hardened against traversal in 4.30 CVE-2026-54917, but the copy-source header was only checked for emptiness, so a .. segment in the...

CVE-2026-58372

A flaw was found in SeaweedFS. An authenticated remote attacker with write access to a single bucket could exploit a path traversal vulnerability in the S3 gateway. By crafting a DeleteObjects XML request body with specific object keys containing directory traversal sequences, the attacker could...

GO-2026-6221 SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access in github.com/seaweedfs/seaweedfs

SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access in github.com/seaweedfs/seaweedfs...

PT-2026-80444

SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access in github.com/seaweedfs/seaweedfs...

GHSA-W62W-66V9-VVGV SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access

Summary The S3 API gateway and the Iceberg REST catalog gateway construct their routers with mux.NewRouter.SkipCleantrue. With path cleaning disabled, a .. segment inside the URL survives routing, so a request such as: GET /bucket-A/../evil-bucket/key is matched as bucket=bucket-A,...

Exploit for Path Traversal in Seaweedfs

CVE-2026-54917 — SeaweedFS S3 gateway cross-bucket path traver...

CVE-2026-55874

SeaweedFS's S3 API gateway is affected prior to version 4.34 by a path traversal issue in the X-Amz-Copy-Source header (dot-dot segments) that can enable an authenticated user scoped to one bucket to read objects from other buckets via server-side copy. The issue is documented across CVE-2026-558...

CVE-2026-58372

SeaweedFS before 4.34 contains a path traversal vulnerability in the S3 gateway DeleteMultipleObjectsHandler that allows authenticated S3 principals with write access to a single bucket to delete arbitrary objects in other tenants' buckets by supplying object keys containing ../ sequences in the...

CVE-2026-58372 SeaweedFS < 4.34 - Cross-Bucket Object Deletion via DeleteObjects Request-Body Keys

SeaweedFS before 4.34 contains a path traversal vulnerability in the S3 gateway DeleteMultipleObjectsHandler that allows authenticated S3 principals with write access to a single bucket to delete arbitrary objects in other tenants' buckets by supplying object keys containing ../ sequences in the...

PT-2026-53930

Name of the Vulnerable Software and Affected Versions SeaweedFS versions prior to 4.34 Description A path traversal issue exists in the S3 gateway DeleteMultipleObjectsHandler. Authenticated S3 principals with write access to one bucket can delete arbitrary objects in buckets belonging to other...

CVE-2026-58372: Improper Limitation of a Pathname to a Restricted Directory

SeaweedFS before 4.34 contains a path traversal vulnerability in the S3 gateway DeleteMultipleObjectsHandler that allows authenticated S3 principals with write access to a single bucket to delete arbitrary objects in other tenants' buckets by supplying object keys containing ../ sequences in the...

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass via the router process in the S3 and Iceberg REST gateways when path cleaning is disabled. An attacker can gain unauthorized access to resources in other buckets by crafting requests containing .. segments in the...

CVE-2026-54917

SeaweedFS is a distributed storage system for object storage S3, file systems, and Iceberg tables. Prior to 4.30, the S3 API gateway and the Iceberg REST catalog gateway construct their routers with mux.NewRouter.SkipCleantrue. With path cleaning disabled, a .. segment inside the URL survives...

SUSE CVE-2025-68671

lakeFS is an open-source tool that transforms object storage into a Git-like repositories. LakeFS's S3 gateway does not validate timestamps in authenticated requests, allowing replay attacks. Prior to 1.75.0, an attacker who captures a valid signed request e.g., through network interception, logs...