31 matches found
SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access
Summary The S3 API gateway and the Iceberg REST catalog gateway construct their routers with mux.NewRouter.SkipCleantrue. With path cleaning disabled, a .. segment inside the URL survives routing, so a request such as: GET /bucket-A/../evil-bucket/key is matched as bucket=bucket-A,...
10CVSS5.4AI score0.00385EPSS
SaveExploits2References5Affected Software1
20