Skip to content
CVSS 10.0CVSS 10.0 · CRITICAL

CVE-2026-54917

SeaweedFS is a distributed storage system for object storage (S3), file systems, and Iceberg tables. Prior to 4.30, the S3 API gateway and the Iceberg REST catalog gateway construct their routers with mux.NewRouter().SkipClean(true). With path cleaning disabled, a .. segment inside the URL survives routing, so a request such as `GET /bucket-A/../evil-bucket/key`, is matched as bucket=bucket-A, object=../evil-bucket/key. The captured object key is then joined into a filer path with util.JoinPath (S3) / path.Join (Iceberg), which collapse the .. server-side, so the actual read or write lands in evil-bucket. This vulnerability is fixed in 4.30.

Ver en NVD

Análisis

SeaweedFS presenta una vulnerabilidad crítica de path traversal en sus gateways S3 e Iceberg debido a una configuración incorrecta en el enrutamiento de URLs. Un atacante puede utilizar segmentos de punto-punto-diagonal para acceder, leer o escribir archivos en buckets o rutas arbitrarias fuera de los límites permitidos. Es necesario actualizar a la versión 4.30 para prevenir el compromiso total de la integridad de los datos almacenados.

Roles relevantes

BackendCloudGoCyberSecurityNosqlDocker

Severidad

Puntaje: 10.0(CRITICAL)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
AV: NETWORK
AC: LOW
PR: NONE
UI: NONE
S: CHANGED
C: HIGH
I: HIGH
A: NONE
Tipo de falla (CWE): CWE-22

EPSS

Probabilidad de explotación (próx. 30 días): 0.0034 (0.3%)
Percentil: 26.3%
EPSS: 2026-06-29

Afecta

seaweedfs:seaweedfs

Descripción técnica

SeaweedFS is a distributed storage system for object storage (S3), file systems, and Iceberg tables. Prior to 4.30, the S3 API gateway and the Iceberg REST catalog gateway construct their routers with mux.NewRouter().SkipClean(true). With path cleaning disabled, a .. segment inside the URL survives routing, so a request such as `GET /bucket-A/../evil-bucket/key`, is matched as bucket=bucket-A, object=../evil-bucket/key. The captured object key is then joined into a filer path with util.JoinPath (S3) / path.Join (Iceberg), which collapse the .. server-side, so the actual read or write lands in evil-bucket. This vulnerability is fixed in 4.30.

Publicada: 25/6/2026, 19:16:42
Última modificación: 29/6/2026, 21:21:10

Referencias

InicioEventosBlogRecursosEquipo