121 matches found
CVE-2026-58372
A flaw was found in SeaweedFS. An authenticated remote attacker with write access to a single bucket could exploit a path traversal vulnerability in the S3 gateway. By crafting a DeleteObjects XML request body with specific object keys containing directory traversal sequences, the attacker could...
BIT-SEAWEEDFS-2026-73080 SeaweedFS: Unauthenticated SSRF with response read-back via VolumeServer.FetchAndWriteNeedle
SeaweedFS is a distributed storage system. Prior to 4.24, VolumeServer.FetchAndWriteNeedle in weed/server/volumegrpcremote.go fetches a caller-supplied remote endpoint through weed/remotestorage/s3/s3storageclient.go and writes the response into a needle. The RPC performs no authentication and no...
BIT-SEAWEEDFS-2026-72921 SeaweedFS: Filer JWT allowed_prefixes literal prefix match allows cross-tenant access to sibling paths
SeaweedFS is a distributed storage system. Prior to 4.24, the weed/server/filerserverhandlers.go allowedprefixes authorization check used strings.HasPrefix on raw path strings, so a filer JWT scoped to /tenant1 also authorized sibling paths such as /tenant1234, /tenant1-old, and /tenant1backup,...
BIT-SEAWEEDFS-2026-72920 SeaweedFS: Unauthenticated filer IAM gRPC service grants S3 administrative control
SeaweedFS is a distributed storage system. Prior to 4.24, the filer registers the SeaweedIdentityAccessManagement gRPC service without mandatory authentication when jwt.filersigning.key is unset, allowing any client that can reach the filer gRPC port to invoke CreateUser, CreateAccessKey,...
CVE-2026-46603 vulnerabilities
Vulnerabilities for packages: kubescape, mailpit, kubescape-server, seaweedfs-operator, seaweedfs-rocksdb-fips, fortio, kitty, ollama, pdfcpu, seaweedfs-operator-fips, rclone-fips, gitea, bento-fips, mailpit-fips, bento, seaweedfs, ollama-fips, seaweedfs-rocksdb, fortio-fips, seaweedfs-fips, nemo...
GO-2026-6222 vulnerabilities
Vulnerabilities for packages: kubescape, mailpit, kubescape-server, seaweedfs-operator, seaweedfs-rocksdb-fips, fortio, kitty, ollama, pdfcpu, seaweedfs-operator-fips, rclone-fips, gitea, bento-fips, mailpit-fips, bento, seaweedfs, ollama-fips, seaweedfs-rocksdb, fortio-fips, seaweedfs-fips, nemo...
GO-2026-6222 vulnerabilities
Vulnerabilities for packages: bento, kitty, rclone, gitea, ollama, pdfcpu, kubescape, mattermost, mailpit, seaweedfs...
CVE-2026-46603 vulnerabilities
Vulnerabilities for packages: bento, kitty, rclone, gitea, ollama, pdfcpu, kubescape, mattermost, mailpit, seaweedfs...
GO-2025-3690 vulnerabilities
Vulnerabilities for packages: seaweedfs-operator, seaweedfs-operator-fips...
GO-2026-4815 vulnerabilities
Vulnerabilities for packages: mailpit-fips, seaweedfs-operator-fips, mailpit, hugo, listmonk, seaweedfs-fips, seaweedfs-operator, hugo-fips, hugo-extended, rclone-fips, mattermost, rclone, mattermost-fips, seaweedfs, ollama, ollama-fips...
GO-2026-5032 vulnerabilities
Vulnerabilities for packages: seaweedfs-operator-fips, seaweedfs-fips, seaweedfs-operator, seaweedfs-rocksdb-fips, mattermost-fips, seaweedfs, seaweedfs-rocksdb, gitlab-workhorse-ce...
GO-2026-5066 vulnerabilities
Vulnerabilities for packages: seaweedfs-operator-fips, hugo, listmonk, seaweedfs-fips, seaweedfs-operator, rclone-fips, mattermost, rclone, mattermost-fips, seaweedfs, gitlab-workhorse-ce...
GO-2026-5031 vulnerabilities
Vulnerabilities for packages: seaweedfs-operator-fips, seaweedfs-fips, seaweedfs-operator, seaweedfs-rocksdb-fips, mattermost-fips, seaweedfs, seaweedfs-rocksdb, gitlab-workhorse-ce...
GO-2026-5062 vulnerabilities
Vulnerabilities for packages: mailpit-fips, seaweedfs-operator-fips, hugo, mailpit, listmonk, seaweedfs-fips, filebrowser, seaweedfs-operator, hugo-fips, seaweedfs-rocksdb-fips, hugo-extended, rclone-fips, mattermost, rclone, mattermost-fips, seaweedfs, seaweedfs-rocksdb, gitlab-workhorse-ce...
GO-2026-5543 vulnerabilities
Vulnerabilities for packages: cert-manager-google-cas-issuer, xeol-fips, k6-fips, cert-manager-fips, cloudbeat-fips, yunikorn-k8shim-fips, teleport, kyverno-notation-aws-fips, bento-fips, percona-server-mongodb-operator-fips, bento, terraform, flux-source-controller, cert-manager-cmctl,...
GO-2026-5031 vulnerabilities
Vulnerabilities for packages: seaweedfs...
GO-2026-5032 vulnerabilities
Vulnerabilities for packages: seaweedfs...
GO-2026-5066 vulnerabilities
Vulnerabilities for packages: seaweedfs, hugo, rclone, mattermost...