Executive brief
SeaweedFS is a distributed file storage system with an S3-compatible API gateway. This vulnerability allows an attacker with limited permissions (read/write access to one bucket) to read objects from any other bucket on the same instance by exploiting a path traversal flaw in the copy-object operation. The attacker can then land stolen data in their own bucket for retrieval, completely bypassing bucket isolation controls.
Technical details
The vulnerability is a path traversal (CWE-22) flaw in SeaweedFS's S3 API gateway. The root cause is insufficient validation of the X-Amz-Copy-Source header in CopyObject and UploadPartCopy operations. While the request URL path was hardened in version 4.30, the copy-source header was only checked for emptiness, allowing `..` segments to survive into server-side path resolution. An attacker with Low privileges (IAM permissions for a single bucket with Read+Write) can craft a CopyObject request with a copy source like `bucket-a/../victim-bucket/key`, causing the gateway to read from `victim-bucket/key` while IAM authorization is evaluated against the destination bucket the attacker controls. The same flaw affects UploadPartCopy. No user interaction is required, and the attack is network-accessible. The fix (version 4.34+) applies the same path validation guards (IsValidBucketName/IsValidObjectKey) to the copy-source header that are already used for request URLs.
Affected products
- SeaweedFS SeaweedFS < 4.34
Timeline
- 2026-08-28: disclosed: GitHub Advisory published
- 2026-06-12: patched: Fix committed (b44cf51fe931bd75aa4d37ae766bea90d7f85ccd)
- 2026-07-08: advisory: NVD published CVE-2026-55874