Junglewise Threat Intelligence

CVE-2026-58371: SeaweedFS information disclosure via unvalidated JSONP callback

CVE-2026-58371 · Severity: low · CVSS 3.1 · Published 2026-06-30

Executive brief

SeaweedFS, an open-source distributed storage system, contained a vulnerability that could allow unauthorized access to sensitive cluster information. By tricking a user into visiting a malicious website, an attacker could exploit the system's handling of certain web requests to read internal data such as server locations, file identifiers, and directory listings. This could lead to the exposure of private infrastructure details and data organization, though it does not directly allow for data modification or deletion.

Technical details

SeaweedFS versions prior to 4.30 contain a vulnerability in the shared 'writeJson' helper (weed/server/common.go) and its Rust equivalent. The application reflects the 'callback' query parameter verbatim in responses with 'Content-Type: application/javascript' without validating the callback name or implementing 'X-Content-Type-Options: nosniff'. This allows for a Cross-Site Script Inclusion (XSSI) attack where a third-party website can use script tags to load JSON endpoints (such as /dir/status or /cluster/status) and capture the reflected data. Additionally, the lack of 'nosniff' headers allows some browsers to interpret the reflected content as HTML, potentially leading to Cross-Site Scripting (XSS). The issue was resolved in version 4.30 by removing JSONP support and enforcing 'application/json' with proper security headers.

Affected products

  • SeaweedFS SeaweedFS < 4.30

Timeline

  • 2026-05-26: patched: Fix committed to master branch and pull request merged.
  • 2026-06-30: disclosed: CVE-2026-58371 published.

References

Related threats