Is CVE-2026-55874 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55874 being exploited in the wild.

How severe is CVE-2026-55874?

High severity, with a CVSS score of 7.7, published 8 July 2026.

Which products and versions are affected?

github.com/seaweedfs/seaweedfs (Go) < 0.0.0-20260612000715-b44cf51fe931, SEMVER:introduced=0,fixed=0.0.0-20260612000715-b44cf51fe931; SeaweedFS < 4.34.

Is there a fix for CVE-2026-55874?

Yes. github.com/seaweedfs/seaweedfs (Go): upgrade to 0.0.0-20260612000715-b44cf51fe931 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55874 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-55874?

Check whether you run github.com/seaweedfs/seaweedfs (Go) or SeaweedFS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55874: SeaweedFS path traversal in S3 API X-Amz-Copy-Source header

Q: Is there a fix for CVE-2026-55874?

Yes. github.com/seaweedfs/seaweedfs (Go): upgrade to 0.0.0-20260612000715-b44cf51fe931 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-55874 attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected by CVE-2026-55874?

Check whether you run github.com/seaweedfs/seaweedfs (Go) or SeaweedFS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55874 · Severity: high · CVSS 7.7 · Published 2026-07-08

SeaweedFS is a distributed file storage system with an S3-compatible API gateway. This vulnerability allows an attacker with limited permissions (read/write access to one bucket) to read objects from any other bucket on the same instance by exploiting a path traversal flaw in the copy-object operation. The attacker can then land stolen data in their own bucket for retrieval, completely bypassing bucket isolation controls.

Technologies: github.com/seaweedfs/seaweedfs (Go), SeaweedFS. Vendors: Go, SeaweedFS.

Quick answers

Is CVE-2026-55874 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55874 being exploited in the wild.
How severe is CVE-2026-55874?: High severity, with a CVSS score of 7.7, published 8 July 2026.
Which products and versions are affected?: github.com/seaweedfs/seaweedfs (Go) < 0.0.0-20260612000715-b44cf51fe931, SEMVER:introduced=0,fixed=0.0.0-20260612000715-b44cf51fe931; SeaweedFS < 4.34.
Is there a fix for CVE-2026-55874?: Yes. github.com/seaweedfs/seaweedfs (Go): upgrade to 0.0.0-20260612000715-b44cf51fe931 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55874 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-55874?: Check whether you run github.com/seaweedfs/seaweedfs (Go) or SeaweedFS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/seaweedfs/seaweedfs (Go): upgrade to 0.0.0-20260612000715-b44cf51fe931 or later
```
go get github.com/seaweedfs/seaweedfs@v0.0.0-20260612000715-b44cf51fe931
```

Technical details

The vulnerability is a path traversal (CWE-22) flaw in SeaweedFS's S3 API gateway. The root cause is insufficient validation of the X-Amz-Copy-Source header in CopyObject and UploadPartCopy operations. While the request URL path was hardened in version 4.30, the copy-source header was only checked for emptiness, allowing `..` segments to survive into server-side path resolution. An attacker with Low privileges (IAM permissions for a single bucket with Read+Write) can craft a CopyObject request with a copy source like `bucket-a/../victim-bucket/key`, causing the gateway to read from `victim-bucket/key` while IAM authorization is evaluated against the destination bucket the attacker controls. The same flaw affects UploadPartCopy. No user interaction is required, and the attack is network-accessible. The fix (version 4.34+) applies the same path validation guards (IsValidBucketName/IsValidObjectKey) to the copy-source header that are already used for request URLs.

Affected products

SeaweedFS SeaweedFS < 4.34

Identifiers

CVE-2026-55874
GHSA-56wq-x3wv-3ff4
GO-2026-6327

Timeline

2026-08-28: disclosed: GitHub Advisory published
2026-06-12: patched: Fix committed (b44cf51fe931bd75aa4d37ae766bea90d7f85ccd)
2026-07-08: advisory: NVD published CVE-2026-55874

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.