141 matches found
CVE-2026-77763
The filestore backend in pkg/object/file.go, used for file:// stores and as a common juicefs sync destination, derived every operation's target from pathkey, which returned either filepath.Joind.root, key or filepath.Cleand.root + key with no check that the result stayed beneath the root. Put, Ge...
CVE-2026-77763 JuiceFS Local Filestore Backend Joins Object Keys onto the Storage Root Without a Containment Check, Allowing Writes Outside the Configured Directory
The filestore backend in pkg/object/file.go, used for file:// stores and as a common juicefs sync destination, derived every operation's target from pathkey, which returned either filepath.Joind.root, key or filepath.Cleand.root + key with no check that the result stayed beneath the root. Put, Ge...
EUVD-2026-63899
The filestore backend in pkg/object/file.go, used for file:// stores and as a common juicefs sync destination, derived every operation's target from pathkey, which returned either filepath.Joind.root, key or filepath.Cleand.root + key with no check that the result stayed beneath the root. Put, Ge...
CVE-2026-77763
JuiceFS filestore backend (pkg/object/file.go) contains a path traversal vulnerability. The path(key) function joined object keys onto the storage root using filepath.Join or filepath.Clean without verifying the resolved path remained beneath the root. All operations—Put, Get, Head, Delete, Chmod...
CVE-2026-77763 JuiceFS Local Filestore Backend Joins Object Keys onto the Storage Root Without a Containment Check, Allowing Writes Outside the Configured Directory
The filestore backend in pkg/object/file.go, used for file:// stores and as a common juicefs sync destination, derived every operation's target from pathkey, which returned either filepath.Joind.root, key or filepath.Cleand.root + key with no check that the result stayed beneath the root. Put, Ge...
GO-2026-6091 vulnerabilities
Vulnerabilities for packages: cloud-provider-vsphere, cue, cloudprober, flux-kustomize-controller, terraform-provider-sendgrid, cilium-cli, kube-metrics-adapter, golangci-lint, gh, seaweedfs, spire-server, crossplane-provider-aws-sns, go-discover, dagdotdev, polaris, sftpgo, tetragon,...
CVE-2026-56858 vulnerabilities
Vulnerabilities for packages: cloud-provider-vsphere, cue, cloudprober, flux-kustomize-controller, terraform-provider-sendgrid, cilium-cli, kube-metrics-adapter, golangci-lint, gh, seaweedfs, spire-server, crossplane-provider-aws-sns, go-discover, dagdotdev, polaris, sftpgo, tetragon,...
GO-2026-6088 vulnerabilities
Vulnerabilities for packages: cloud-provider-vsphere, cue, cloudprober, flux-kustomize-controller, neuvector-dbgen, cilium-cli, kube-metrics-adapter, golangci-lint, gh, seaweedfs, spire-server, crossplane-provider-aws-sns, go-discover, local-path-provisioner, mountpoint-s3-csi-driver, polaris,...
CVE-2026-56859 vulnerabilities
Vulnerabilities for packages: cloud-provider-vsphere, cue, cloudprober, flux-kustomize-controller, neuvector-dbgen, cilium-cli, kube-metrics-adapter, golangci-lint, gh, seaweedfs, spire-server, crossplane-provider-aws-sns, go-discover, local-path-provisioner, mountpoint-s3-csi-driver, polaris,...
GO-2022-0368 vulnerabilities
Vulnerabilities for packages: juicefs...
GO-2024-3134 vulnerabilities
Vulnerabilities for packages: juicefs...
GO-2024-3130 vulnerabilities
Vulnerabilities for packages: juicefs...
GO-2026-4969 vulnerabilities
Vulnerabilities for packages: kubernetes-dns-node-cache-fips, k8sgateway-fips, eks-distro-fips, kubernetes-dns-node-cache, k8sgateway, eks-distro, juicefs...
GO-2025-3743 vulnerabilities
Vulnerabilities for packages: kubernetes-dns-node-cache-fips, eks-distro-fips, kubernetes-dns-node-cache, eks-distro, juicefs...
GO-2026-5667 vulnerabilities
Vulnerabilities for packages: kubernetes-dns-node-cache-fips, k8sgateway-fips, eks-distro-fips, kubernetes-dns-node-cache, k8sgateway, eks-distro, juicefs...
GO-2026-4808 vulnerabilities
Vulnerabilities for packages: etcd, juicefs...
GO-2026-4806 vulnerabilities
Vulnerabilities for packages: etcd, juicefs...
GO-2026-5417 vulnerabilities
Vulnerabilities for packages: kubernetes-dns-node-cache-fips, k8sgateway-fips, eks-distro-fips, kubernetes-dns-node-cache, k8sgateway, eks-distro, juicefs...