Executive brief
SeaweedFS is a distributed storage system used to store and manage files across multiple servers in multi-tenant environments. A flaw in its JWT-based path authorization allows a token scoped to one tenant path (e.g., `/tenant1`) to also access sibling paths with similar names (e.g., `/tenant1234`, `/tenant1-old`). This enables unauthorized cross-tenant data access for both reading and writing, affecting the confidentiality and integrity of isolated tenant data.
Technical details
The vulnerability is a path traversal / authorization bypass in SeaweedFS Filer's JWT validation logic. The affected component `weed/server/filer_server_handlers.go` uses `strings.HasPrefix()` for a literal byte-prefix match when validating tokens against the `allowed_prefixes` configuration. This means a token authorized for `/tenant1` will incorrectly match paths like `/tenant1234`, `/tenant1-old`, and `/tenant1backup`. The attack requires a valid, legitimately-issued JWT scoped to a tenant; an attacker cannot forge tokens. Once in possession of a scoped token, the holder can read and write to unintended tenant directories. The fix, available in version 4.24 and later, normalizes paths with `path.Clean()` and matches on `/`-separated path components, ensuring `/tenant1` only authorizes `/tenant1` and its true descendants.
Affected products
- SeaweedFS SeaweedFS < 4.24
Timeline
- 2026-07-08: disclosed
- 2026-09-02: advisory: GitHub Advisory published
- 2026-04-12: patched: Fixed in version 4.24