72 matches found
GO-2026-6351 SeaweedFS: Unauthenticated filer IAM gRPC service grants S3 administrative control in github.com/seaweedfs/seaweedfs
SeaweedFS: Unauthenticated filer IAM gRPC service grants S3 administrative control in github.com/seaweedfs/seaweedfs...
GO-2026-6361 SeaweedFS: Filer JWT allowed_prefixes literal prefix match allows cross-tenant access to sibling paths in github.com/seaweedfs/seaweedfs
SeaweedFS: Filer JWT allowedprefixes literal prefix match allows cross-tenant access to sibling paths in github.com/seaweedfs/seaweedfs...
Improper Authentication
github.com/seaweedfs/seaweedfs is vulnerable to improper authentication. The vulnerability is due to the filer registering the SeaweedIdentityAccessManagement gRPC service without mandatory authentication when jwt.filersigning.key is unset, which allows an attacker who can reach the filer gRPC po...
EUVD-2026-56159
SeaweedFS: Filer JWT allowedprefixes literal prefix match allows cross-tenant access to sibling paths...
GHSA-2V6V-25FM-P4FG SeaweedFS: Unauthenticated filer IAM gRPC service grants S3 administrative control
Impact The filer registered the IAM gRPC service SeaweedIdentityAccessManagement with no authentication. Any client able to reach the filer gRPC port could invoke IAM RPCs — CreateUser, CreateAccessKey, PutUserPolicy, and related calls — to mint credentials and grant itself S3 administrative...
CVE-2026-77368 SeaweedFS: Authenticated Cross-Prefix IDOR in Filer TUS Handler Enables Arbitrary Write to Tenant-Forbidden Paths
SeaweedFS is a distributed storage system for files and blobs. In version 4.39, the filer's TUS resumable-upload handler checks JWT allowedprefixes scoping only when a session is created, letting a low-privilege tenant hijack another tenant's upload session to write content to filer paths their o...
CVE-2026-77368 SeaweedFS: Authenticated Cross-Prefix IDOR in Filer TUS Handler Enables Arbitrary Write to Tenant-Forbidden Paths
SeaweedFS is a distributed storage system for files and blobs. In version 4.39, the filer's TUS resumable-upload handler checks JWT allowedprefixes scoping only when a session is created, letting a low-privilege tenant hijack another tenant's upload session to write content to filer paths their o...
CVE-2026-77368
SeaweedFS version 4.39 contains an authenticated cross-prefix IDOR in the filer's TUS resumable-upload handler . The JWT allowed_prefixes scoping is enforced only when an upload session is created; the HEAD , PATCH , and DELETE verbs that operate on an existing session by its identifier never re-...
CVE-2026-77368 SeaweedFS: Authenticated Cross-Prefix IDOR in Filer TUS Handler Enables Arbitrary Write to Tenant-Forbidden Paths
SeaweedFS is a distributed storage system for files and blobs. In version 4.39, the filer's TUS resumable-upload handler checks JWT allowedprefixes scoping only when a session is created, letting a low-privilege tenant hijack another tenant's upload session to write content to filer paths their o...
CVE-2026-77368: Authorization Bypass Through User-Controlled Key
SeaweedFS is a distributed storage system for files and blobs. In version 4.39, the filer's TUS resumable-upload handler checks JWT allowedprefixes scoping only when a session is created, letting a low-privilege tenant hijack another tenant's upload session to write content to filer paths their o...
BIT-SEAWEEDFS-2026-72921 SeaweedFS: Filer JWT allowed_prefixes literal prefix match allows cross-tenant access to sibling paths
SeaweedFS is a distributed storage system. Prior to 4.24, the weed/server/filerserverhandlers.go allowedprefixes authorization check used strings.HasPrefix on raw path strings, so a filer JWT scoped to /tenant1 also authorized sibling paths such as /tenant1234, /tenant1-old, and /tenant1backup,...
PT-2026-73436
SeaweedFS is a distributed storage system. Prior to 4.24, the weed/server/filer server handlers.go allowed prefixes authorization check used strings.HasPrefix on raw path strings, so a filer JWT scoped to /tenant1 also authorized sibling paths such as /tenant1234, /tenant1-old, and /tenant1backup...
CVE-2026-72921
SeaweedFS is a distributed storage system. Prior to 4.24, the weed/server/filerserverhandlers.go allowedprefixes authorization check used strings.HasPrefix on raw path strings, so a filer JWT scoped to /tenant1 also authorized sibling paths such as /tenant1234, /tenant1-old, and /tenant1backup,...
CVE-2026-72921
SeaweedFS CVE-2026-72921 affects the filer server component where the authorization check used strings.HasPrefix on raw path strings, allowing a JWT scoped to /tenant1 to access sibling paths like /tenant1234, /tenant1-old, and /tenant1backup. Root cause: prefix-based path matching without proper...
CVE-2026-72921 SeaweedFS: Filer JWT allowed_prefixes literal prefix match allows cross-tenant access to sibling paths
SeaweedFS is a distributed storage system. Prior to 4.24, the weed/server/filerserverhandlers.go allowedprefixes authorization check used strings.HasPrefix on raw path strings, so a filer JWT scoped to /tenant1 also authorized sibling paths such as /tenant1234, /tenant1-old, and /tenant1backup,...
PYSEC-2026-1298 Django Filer Unrestricted Upload of File with Dangerous Type
Unrestricted Upload of File with Dangerous Type, Improper Input Validation, Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in django CMS Association django Filer allows Input Data Manipulation, Stored XSS.This issue affects django Filer: from 3 before 3....
Django Filer Unrestricted Upload of File with Dangerous Type
Unrestricted Upload of File with Dangerous Type, Improper Input Validation, Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in django CMS Association django Filer allows Input Data Manipulation, Stored XSS.This issue affects django Filer: from 3 before 3....
CVE-2026-58371 SeaweedFS < 4.30 - Cross-Origin Information Disclosure via Unvalidated JSONP callback Parameter
SeaweedFS before 4.30 reflects the callback query parameter verbatim into responses served with Content-Type application/javascript in the shared writeJson helper weed/server/common.go, with no callback-name validation, no X-Content-Type-Options: nosniff header, and no CORS allow-list. Every JSON...
CVE-2025-65473
An arbitrary file rename vulnerability in the /admin/filer.php component of EasyImages 2.0 v2.8.6 and below allows attackers with Administrator privileges to execute arbitrary code via injecting a crafted payload into an uploaded file name...