# CVE-2026-58371: SeaweedFS information disclosure via unvalidated JSONP callback

Source: https://junglewise.ai/threats/cve-2026-58371-seaweedfs-information-disclosure-via-unvalidated-jsonp-callback  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-30. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-58371 · Severity: low · CVSS 3.1 · Published 2026-06-30

SeaweedFS, an open-source distributed storage system, contained a vulnerability that could allow unauthorized access to sensitive cluster information. By tricking a user into visiting a malicious website, an attacker could exploit the system's handling of certain web requests to read internal data such as server locations, file identifiers, and directory listings. This could lead to the exposure of private infrastructure details and data organization, though it does not directly allow for data modification or deletion.

Technologies: [SeaweedFS](https://junglewise.ai/threats/technologies/seaweedfs). Vendors: [SeaweedFS](https://junglewise.ai/threats/vendors/seaweedfs).

## Quick answers

**Is CVE-2026-58371 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-58371 being exploited in the wild.

**How severe is CVE-2026-58371?** Low severity, with a CVSS score of 3.1, published 30 June 2026.

**Which products and versions are affected?** SeaweedFS < 4.30.

**Is there a fix for CVE-2026-58371?** A patch was published on 2026-05-26: Fix committed to master branch and pull request merged. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-58371 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-58371?** Check whether you run SeaweedFS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

SeaweedFS versions prior to 4.30 contain a vulnerability in the shared 'writeJson' helper (weed/server/common.go) and its Rust equivalent. The application reflects the 'callback' query parameter verbatim in responses with 'Content-Type: application/javascript' without validating the callback name or implementing 'X-Content-Type-Options: nosniff'. This allows for a Cross-Site Script Inclusion (XSSI) attack where a third-party website can use script tags to load JSON endpoints (such as /dir/status or /cluster/status) and capture the reflected data. Additionally, the lack of 'nosniff' headers allows some browsers to interpret the reflected content as HTML, potentially leading to Cross-Site Scripting (XSS). The issue was resolved in version 4.30 by removing JSONP support and enforcing 'application/json' with proper security headers.

## Affected products

- SeaweedFS SeaweedFS < 4.30

## Timeline

- 2026-05-26: patched: Fix committed to master branch and pull request merged.
- 2026-06-30: disclosed: CVE-2026-58371 published.

## References

- [https://github.com/geo-chen/oss/blob/main/seaweedfs.md](https://github.com/geo-chen/oss/blob/main/seaweedfs.md)
- [https://github.com/seaweedfs/seaweedfs/commit/77dcb20a7485074d37340985d53103f94538abe6](https://github.com/seaweedfs/seaweedfs/commit/77dcb20a7485074d37340985d53103f94538abe6)
- [https://github.com/seaweedfs/seaweedfs/pull/9686](https://github.com/seaweedfs/seaweedfs/pull/9686)
- [https://github.com/seaweedfs/seaweedfs/releases/tag/4.30](https://github.com/seaweedfs/seaweedfs/releases/tag/4.30)
- [https://www.vulncheck.com/advisories/seaweedfs-cross-origin-information-disclosure-via-unvalidated-jsonp-callback-parameter](https://www.vulncheck.com/advisories/seaweedfs-cross-origin-information-disclosure-via-unvalidated-jsonp-callback-parameter)

## Related threats

- [SeaweedFS SFTP Helm chart hardcoded Ed25519 host key](https://junglewise.ai/threats/cve-2026-100413-seaweedfs-is-a-distributed-storage-system-for-files-and-blobs)
- [SeaweedFS unauthenticated filer IAM gRPC service authentication bypass](https://junglewise.ai/threats/cve-2026-72920-seaweedfs-unauthenticated-filer-iam-grpc-service-authentication)
- [SeaweedFS S3 object-scope bypass in PutObjectAcl](https://junglewise.ai/threats/cve-2026-77611-seaweedfs-s3-object-scope-bypass-in-putobjectacl)
- [SeaweedFS TUS resumable-upload JWT authorization bypass](https://junglewise.ai/threats/cve-2026-77368-seaweedfs-tus-resumable-upload-jwt-authorization-bypass)
- [SeaweedFS SFTP path ACL literal prefix matching bypass](https://junglewise.ai/threats/cve-2026-77317-seaweedfs-sftp-path-acl-literal-prefix-matching-bypass)