Executive brief
SeaweedFS is a distributed storage system offering SFTP access to files and blobs. An authenticated SFTP user with limited permissions to a specific path (e.g., /tenants/alice) can also access sibling paths that share the same name prefix (e.g., /tenants/alice-archive or /tenants/alice2), bypassing the intended access controls and potentially exposing or modifying other tenants' data.
Technical details
The SFTP server in SeaweedFS uses strings.HasPrefix() for path ACL validation instead of enforcing path-component boundaries. A user granted access to /tenants/alice matches any path starting with that string, including siblings like /tenants/alice-archive, /tenants/alice-backup, or /tenants/alice2. The vulnerability affects SFTP users with a root home directory (HomeDir: "/") and scoped permissions; an authenticated attacker can read or overwrite files in unintended sibling paths if granted read or write permissions. The fix, released in version 4.40, uses path normalization and requires either exact path equality or separator-delimited descendant validation via a pathWithin() helper function.
Affected products
- SeaweedFS SeaweedFS 3.88 through 4.39
Timeline
- 2026-08-26: disclosed
- 2026-07-10: patched: Fix committed; released in version 4.40