CVE-2026-77763

JuiceFS filestore backend (pkg/object/file.go) contains a path traversal vulnerability. The path(key) function joined object keys onto the storage root using filepath.Join or filepath.Clean without verifying the resolved path remained beneath the root. All operations—Put, Get, Head, Delete, Chmod...

EUVD-2026-63899

The filestore backend in pkg/object/file.go, used for file:// stores and as a common juicefs sync destination, derived every operation's target from pathkey, which returned either filepath.Joind.root, key or filepath.Cleand.root + key with no check that the result stayed beneath the root. Put, Ge...