# CVE-2026-58372: SeaweedFS path traversal in S3 gateway DeleteMultipleObjectsHandler

Source: https://junglewise.ai/threats/cve-2026-58372-seaweedfs-path-traversal-in-s3-gateway  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-30. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-58372 · Severity: high · CVSS 8.1 · Published 2026-06-30

SeaweedFS, a distributed storage system, contains a security flaw in its S3-compatible gateway. An authenticated user with permission to write to a single storage bucket can exploit this flaw to delete files in other users' or tenants' buckets. This could lead to unauthorized data loss and disruption of service across a shared storage environment.

Technologies: [SeaweedFS](https://junglewise.ai/threats/technologies/seaweedfs). Vendors: [SeaweedFS](https://junglewise.ai/threats/vendors/seaweedfs).

## Quick answers

**Is CVE-2026-58372 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-58372 being exploited in the wild.

**How severe is CVE-2026-58372?** High severity, with a CVSS score of 8.1, published 30 June 2026.

**Which products and versions are affected?** SeaweedFS < 4.34.

**Is there a fix for CVE-2026-58372?** A patch was published on 2026-06-11: Fix committed to master branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-58372 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-58372?** Check whether you run SeaweedFS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A path traversal vulnerability exists in the SeaweedFS S3 gateway's DeleteMultipleObjectsHandler. The root cause is a 'confused deputy' condition where the validateRequestPath middleware only validates URL-captured path variables but fails to inspect object keys within the XML request body. An attacker can provide object keys containing '../' sequences which are subsequently collapsed by the filer path logic, resolving to locations outside the authorized bucket. This allows an authenticated user with limited bucket access to perform cross-tenant object deletion. The issue is fixed in version 4.34 by implementing stricter validation of indirect filer path inputs.

## Affected products

- SeaweedFS SeaweedFS < 4.34

## Timeline

- 2026-06-11: patched: Fix committed to master branch
- 2026-06-30: disclosed: CVE published

## References

- [https://github.com/geo-chen/oss/blob/main/seaweedfs.md](https://github.com/geo-chen/oss/blob/main/seaweedfs.md)
- [https://github.com/seaweedfs/seaweedfs/commit/0345658ea8e7c6a3948ad190634b00866ec244c9](https://github.com/seaweedfs/seaweedfs/commit/0345658ea8e7c6a3948ad190634b00866ec244c9)
- [https://github.com/seaweedfs/seaweedfs/pull/9931](https://github.com/seaweedfs/seaweedfs/pull/9931)
- [https://github.com/seaweedfs/seaweedfs/releases/tag/4.34](https://github.com/seaweedfs/seaweedfs/releases/tag/4.34)
- [https://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-w62w-66v9-vvgv](https://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-w62w-66v9-vvgv)
- [https://www.vulncheck.com/advisories/seaweedfs-cross-bucket-object-deletion-via-deleteobjects-request-body-keys](https://www.vulncheck.com/advisories/seaweedfs-cross-bucket-object-deletion-via-deleteobjects-request-body-keys)

## Related threats

- [SeaweedFS SFTP Helm chart hardcoded Ed25519 host key](https://junglewise.ai/threats/cve-2026-100413-seaweedfs-is-a-distributed-storage-system-for-files-and-blobs)
- [SeaweedFS unauthenticated filer IAM gRPC service authentication bypass](https://junglewise.ai/threats/cve-2026-72920-seaweedfs-unauthenticated-filer-iam-grpc-service-authentication)
- [SeaweedFS S3 object-scope bypass in PutObjectAcl](https://junglewise.ai/threats/cve-2026-77611-seaweedfs-s3-object-scope-bypass-in-putobjectacl)
- [SeaweedFS TUS resumable-upload JWT authorization bypass](https://junglewise.ai/threats/cve-2026-77368-seaweedfs-tus-resumable-upload-jwt-authorization-bypass)
- [SeaweedFS SFTP path ACL literal prefix matching bypass](https://junglewise.ai/threats/cve-2026-77317-seaweedfs-sftp-path-acl-literal-prefix-matching-bypass)