Executive brief
JuiceFS is a distributed file system used to sync data between cloud storage buckets and local directories. A path traversal vulnerability in the filestore backend allows an attacker to write files outside the intended sync destination directory by crafting malicious object keys. An operator syncing from a shared or public bucket, or one they don't fully control, could have arbitrary files written to unexpected locations on their system.
Technical details
The vulnerability is a path traversal flaw in pkg/object/file.go's path() function, which constructs target file paths by joining a root directory with an object key without validating that the result stays within the root. The functions Put, Get, Head, Delete, Chmod, Chown, Symlink, and Readlink all use this unsanitized path directly. Object keys from source stores are not constrained the way local filesystem names are, so an attacker can inject traversal sequences (e.g., "../") to escape the root directory. The attack requires the operator to sync from a bucket containing attacker-controlled content. The fix validates that resolved paths remain within the root and rejects any key that escapes it.
Affected products
- JuiceData JuiceFS
Timeline
- 2026-08-21: disclosed