SeaweedFS is a distributed storage system designed to efficiently store and manage large volumes of files and object data across multiple nodes. It is commonly used by developers, system administrators, cloud infrastructure teams, and organizations that require scalable and resilient storage environments. The platform provides several storage interfaces, including an S3-compatible API, allowing applications designed for object storage services to interact with SeaweedFS. It can be deployed in cloud, on-premises, and distributed infrastructure where high availability and horizontal scalability are important requirements. SeaweedFS is often used for workloads involving object storage, file serving, backups, application data, and other large-scale storage requirements. Its distributed architecture enables organizations to expand storage capacity while maintaining efficient access to data across connected systems.
SeaweedFS versions up to and including 4.29 are affected by a path traversal vulnerability identified as CVE-2026-54917. The vulnerability results from improper handling of URL paths within the S3 API and Iceberg REST catalog routing components. A specially crafted request containing a .. path segment can reach application handlers without being normalized by the router. This behavior allows the object path processed by the storage layer to differ from the bucket against which authorization is evaluated. As a result, an attacker can cause an object intended for one bucket path to be written into another bucket. Successful exploitation can therefore bypass bucket-level access restrictions and permit unauthorized cross-bucket file writes.
The vulnerability is caused by the affected S3 API and Iceberg REST catalog routers being configured with mux.NewRouter().SkipClean(true), which disables automatic URL path cleaning. Because path normalization is skipped, traversal sequences such as .. remain present when the request is matched and passed to the corresponding request handler. For example, a request to a path structured as /bucket-A/../evil-bucket/key can be interpreted during routing as a request for bucket-A with an object key containing ../evil-bucket/key. Authorization is evaluated using the originally matched bucket, while the captured object key is subsequently joined into a filer path. During this server-side path construction, the traversal segment is collapsed, causing the object to be written into the unintended target bucket. The scanner verifies this behavior by creating a source bucket, writing a randomly generated object through a traversal path, and then requesting the object directly from the destination bucket to confirm that the cross-bucket write occurred.
Successful exploitation of CVE-2026-54917 can allow unauthorized users to write objects into buckets for which they should not have write access. This can compromise the integrity of stored data by enabling attackers to introduce, replace, or manipulate content across storage boundaries. Applications consuming objects from affected buckets may subsequently process attacker-controlled files or data, potentially creating additional security risks depending on how those objects are used. Cross-bucket writes can also undermine tenant or application isolation where separate buckets are relied upon to enforce logical access boundaries. In environments containing sensitive or operationally important data, unauthorized modifications may disrupt application behavior, corrupt stored information, or interfere with dependent services. Organizations running affected versions should therefore upgrade to SeaweedFS 4.30 or later to ensure that request paths are handled securely and bucket-level access controls cannot be bypassed through path traversal.
REFERENCES
- Upgrade to SeaweedFS version 4.30 or later to patch the vulnerability.
- Implement strict validation on the URL paths to prevent path traversal attacks.
- Regularly monitor system logs for unusual file access or writing patterns.
- Restrict permissions to minimize the impact of unauthorized access.
- Conduct regular security assessments of the storage systems and APIs used.
Get AI-powered remediation steps tailored to your asset.
Try AI Solutions →