Executive brief
SeaweedFS, a distributed storage system, contains a security flaw in its S3-compatible gateway. An authenticated user with permission to write to a single storage bucket can exploit this flaw to delete files in other users' or tenants' buckets. This could lead to unauthorized data loss and disruption of service across a shared storage environment.
Technical details
A path traversal vulnerability exists in the SeaweedFS S3 gateway's DeleteMultipleObjectsHandler. The root cause is a 'confused deputy' condition where the validateRequestPath middleware only validates URL-captured path variables but fails to inspect object keys within the XML request body. An attacker can provide object keys containing '../' sequences which are subsequently collapsed by the filer path logic, resolving to locations outside the authorized bucket. This allows an authenticated user with limited bucket access to perform cross-tenant object deletion. The issue is fixed in version 4.34 by implementing stricter validation of indirect filer path inputs.
Affected products
- SeaweedFS SeaweedFS < 4.34
Timeline
- 2026-06-11: patched: Fix committed to master branch
- 2026-06-30: disclosed: CVE published
References
- https://github.com/geo-chen/oss/blob/main/seaweedfs.md
- https://github.com/seaweedfs/seaweedfs/commit/0345658ea8e7c6a3948ad190634b00866ec244c9
- https://github.com/seaweedfs/seaweedfs/pull/9931
- https://github.com/seaweedfs/seaweedfs/releases/tag/4.34
- https://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-w62w-66v9-vvgv
- https://www.vulncheck.com/advisories/seaweedfs-cross-bucket-object-deletion-via-deleteobjects-request-body-keys