CVE-2026-55874 Details
Description
SeaweedFS is a distributed storage system. Prior to 4.34, the S3 API gateway does not reject dot-dot path segments in the X-Amz-Copy-Source header used by CopyObject and UploadPartCopy, allowing an authenticated identity scoped to one bucket to read objects from other buckets through server-side copy. This issue is fixed in version 4.34.
A path traversal vulnerability has been identified in the SeaweedFS S3 API gateway, prior to version 4.34. The issue allows an authenticated user, scoped to a single bucket, to read objects from other buckets by exploiting the X-Amz-Copy-Source header in CopyObject and UploadPartCopy requests. The vulnerability arises because the gateway did not properly validate path segments in the copy source, allowing traversal into different buckets. This issue breaks bucket isolation and can be exploited to bypass authorization controls.
Users can upgrade to SeaweedFS version 4.34 or later, where this vulnerability has been patched. For those unable to upgrade immediately, a reverse proxy can be used to reject requests with an X-Amz-Copy-Source header that contains traversal sequences.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 8, 2026CISA-ADP
Assessed Jul 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/seaweedfs/seaweedfs/commit/b44cf51fe931bd75aa4d37ae766bea90d7f85ccd | [email protected] | Source CodeVendor |
| https://github.com/seaweedfs/seaweedfs/pull/9929 | [email protected] | Issue TrackingVendor |
| https://github.com/seaweedfs/seaweedfs/releases/tag/4.34 | [email protected] | Release NotesVendor |
| https://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-56wq-x3wv-3ff4 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| SeaweedFS | < 4.34 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 8, 2026 | CVE Modified | CISA-ADP |
| Jul 8, 2026 | New CVE Received | [email protected] |