CVE-2026-54917 Details
Description
SeaweedFS is a distributed storage system for object storage (S3), file systems, and Iceberg tables. Prior to 4.30, the S3 API gateway and the Iceberg REST catalog gateway construct their routers with mux.NewRouter().SkipClean(true). With path cleaning disabled, a .. segment inside the URL survives routing, so a request such as `GET /bucket-A/../evil-bucket/key`, is matched as bucket=bucket-A, object=../evil-bucket/key. The captured object key is then joined into a filer path with util.JoinPath (S3) / path.Join (Iceberg), which collapse the .. server-side, so the actual read or write lands in evil-bucket. This vulnerability is fixed in 4.30.
A path traversal vulnerability has been identified in SeaweedFS versions prior to 4.30, specifically within the S3 API gateway and the Iceberg REST catalog gateway. The issue arises because these gateways construct their routers with path cleaning disabled, allowing `..` segments in the URL to bypass routing sanitation. As a result, a request like `GET /bucket-A/../evil-bucket/key` is interpreted as targeting `bucket-A`, but the object key `../evil-bucket/key` is manipulated server-side to access `evil-bucket` instead. This flaw enables unauthorized cross-bucket read and write operations. The vulnerability also affects the Iceberg REST catalog's path variables related to namespaces and tables.
Upgrade to SeaweedFS version 4.30 or later. For deployments that cannot upgrade immediately, a reverse proxy can be placed in front of the gateway to normalize the request path and reject any requests containing `..`, `%2e%2e`, or backslash sequences.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-w62w-66v9-vvgv | CISA-ADP | ExploitPatchVendor Advisory |
| https://github.com/seaweedfs/seaweedfs/pull/9687 | [email protected] | Issue TrackingMitigation |
| https://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-w62w-66v9-vvgv | [email protected] | ExploitPatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| seaweedfs seaweedfs | < 4.30 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 29, 2026 | Initial Analysis | [email protected] |
| Jun 25, 2026 | CVE Modified | CISA-ADP |
| Jun 25, 2026 | New CVE Received | [email protected] |