Executive brief
SeaweedFS, a distributed storage system, contains a vulnerability in its S3 and Iceberg data gateways. An attacker can use specially crafted web requests to bypass security controls and access data stored in private folders (buckets) they are not authorized to see. This could lead to the unauthorized reading or modification of sensitive customer data and breaks the isolation between different users or tenants.
Technical details
A path traversal vulnerability exists in the SeaweedFS S3 API and Iceberg REST catalog gateways due to the use of 'SkipClean(true)' in the gorilla/mux router. This configuration allows '..' segments in URLs to reach the application handlers without normalization. When these segments are subsequently processed by 'util.JoinPath' or 'path.Join', they resolve to paths outside the intended bucket directory. In authenticated environments, this creates a confused deputy scenario where IAM policies are evaluated against the requested bucket name while the actual I/O operation occurs on a different, traversed bucket. The vulnerability is fixed in version 4.30 by adding validation middleware to reject traversal segments.
Affected products
- SeaweedFS SeaweedFS < 4.30
Timeline
- 2026-06-10: advisory: Initial GHSA publication
- 2026-06-25: patched: Version 4.30 released
- 2026-08-12: disclosed: Updated advisory published
References
- https://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-w62w-66v9-vvgv
- https://github.com/seaweedfs/seaweedfs/pull/9687
- https://github.com/seaweedfs/seaweedfs/commit/dd1b4287899eed3dfd73c2f3b1de001996fda229
- https://api.github.com/repos/seaweedfs/seaweedfs/security-advisories/GHSA-w62w-66v9-vvgv