CVE-2026-58372: SeaweedFS path traversal in S3 and Iceberg gateways

CVE-2026-58372 · Severity: high · CVSS 4 · Published 2026-06-25

SeaweedFS, a distributed storage system, contains a vulnerability in its S3 and Iceberg data gateways. An attacker can use specially crafted web requests to bypass security controls and access data stored in private folders (buckets) they are not authorized to see. This could lead to the unauthorized reading or modification of sensitive customer data and breaks the isolation between different users or tenants.

Technologies: github.com/seaweedfs/seaweedfs (Go), SeaweedFS. Vendors: Go, SeaweedFS.

Quick answers

Is CVE-2026-58372 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-58372 being exploited in the wild.
How severe is CVE-2026-58372?
High severity, with a CVSS score of 4, published 25 June 2026.
Which products and versions are affected?
github.com/seaweedfs/seaweedfs (Go) < 0.0.0-20260526080459-dd1b4287899e, SEMVER:introduced=0,fixed=0.0.0-20260526080459-dd1b4287899e; SeaweedFS < 4.30.
Is there a fix for CVE-2026-58372?
Yes. github.com/seaweedfs/seaweedfs (Go): upgrade to 0.0.0-20260526080459-dd1b4287899e or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-58372 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-58372?
Check whether you run github.com/seaweedfs/seaweedfs (Go) or SeaweedFS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/seaweedfs/seaweedfs (Go): upgrade to 0.0.0-20260526080459-dd1b4287899e or later
    go get github.com/seaweedfs/seaweedfs@v0.0.0-20260526080459-dd1b4287899e

Technical details

A path traversal vulnerability exists in the SeaweedFS S3 API and Iceberg REST catalog gateways due to the use of 'SkipClean(true)' in the gorilla/mux router. This configuration allows '..' segments in URLs to reach the application handlers without normalization. When these segments are subsequently processed by 'util.JoinPath' or 'path.Join', they resolve to paths outside the intended bucket directory. In authenticated environments, this creates a confused deputy scenario where IAM policies are evaluated against the requested bucket name while the actual I/O operation occurs on a different, traversed bucket. The vulnerability is fixed in version 4.30 by adding validation middleware to reject traversal segments.

Affected products

  • SeaweedFS SeaweedFS < 4.30

Identifiers

  • CVE-2026-58372
  • CVE-2026-54917
  • GHSA-w62w-66v9-vvgv
  • GO-2026-6221

Timeline

  • 2026-06-10: advisory: Initial GHSA publication
  • 2026-06-25: patched: Version 4.30 released
  • 2026-08-12: disclosed: Updated advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.