Skip to content
OpenAdvisories

Package · Go

github.com/seaweedfs/seaweedfs

7 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.1
    CVE-2026-72921

    SeaweedFS: Filer JWT allowed_prefixes literal prefix match allows cross-tenant access to sibling paths

    SeaweedFS is a distributed storage system. Prior to 4.24, the weed/server/filer_server_handlers.go allowed_prefixes authorization check used strings.HasPrefix on raw path strings, so a filer JWT scoped to /tenant1 also authorized sibling paths such as /tenant…

    seaweedfs seaweedfs github.com/seaweedfs/seaweedfs Go
  • High 7.7
    CVE-2026-55874

    SeaweedFS: Path traversal in the S3 gateway X-Amz-Copy-Source header allows cross-bucket object read

    SeaweedFS is a distributed storage system. Prior to 4.34, the S3 API gateway does not reject dot-dot path segments in the X-Amz-Copy-Source header used by CopyObject and UploadPartCopy, allowing an authenticated identity scoped to one bucket to read objects f…

    seaweedfs seaweedfs github.com/seaweedfs/seaweedfs Go
  • High 7.8
    CVE-2026-54917 Public exploit Scanner template

    SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access

    SeaweedFS is a distributed storage system for object storage (S3), file systems, and Iceberg tables. Prior to 4.30, the S3 API gateway and the Iceberg REST catalog gateway construct their routers with mux.NewRouter().SkipClean(true). With path cleaning disabl…

    seaweedfs seaweedfs github.com/seaweedfs/seaweedfs Go