CVE-2026-58371 SeaweedFS < 4.30 - Cross-Origin Information Disclosure via Unvalidated JSONP callback Parameter

SeaweedFS before 4.30 reflects the callback query parameter verbatim into responses served with Content-Type application/javascript in the shared writeJson helper weed/server/common.go, with no callback-name validation, no X-Content-Type-Options: nosniff header, and no CORS allow-list. Every JSON...

GO-2025-3690 SeaweedFS Vulnerable to SQL Injection in github.com/seaweedfs/seaweedfs

SeaweedFS Vulnerable to SQL Injection in github.com/seaweedfs/seaweedfs...

CVE-2024-40120

seaweedfs v3.68 was discovered to contain a SQL injection vulnerability via the component /abstractsql/abstractsqlstore.go...

GHSA-Q97M-8853-PQ76 SeaweedFS Vulnerable to SQL Injection

seaweedfs v3.68 was discovered to contain a SQL injection vulnerability via the component /abstractsql/abstractsqlstore.go...

PT-2025-21642 · Seaweedfs · Seaweedfs

Name of the Vulnerable Software and Affected Versions: seaweedfs version 3.68 Description: A SQL injection issue was discovered in the component /abstract sql/abstract sql store.go. This issue affects seaweedfs and can be exploited via the vulnerable component. Recommendations: For seaweedfs...