Read the docs
TI-2026-40329 Aliases CVE-2026-55874GHSA-56wq-x3wv-3ff4

SeaweedFS: Path traversal in the S3 gateway X-Amz-Copy-Source header allows cross-bucket object read

Priority LOW 35CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-22 and the CVSS impact.

Summary

SeaweedFS is a distributed storage system. Prior to 4.34, the S3 API gateway does not reject dot-dot path segments in the X-Amz-Copy-Source header used by CopyObject and UploadPartCopy, allowing an authenticated identity scoped to one bucket to read objects from other buckets through server-side copy. This issue is fixed in version 4.34.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00606 49th percentileScored 2026-11-07
Fix Fixed seaweedfs (seaweedfs): 4.34github.com/seaweedfs/seaweedfs (Go): 0.0.0-20260612000715-b44cf51fe931Red Hat: 1 advisory

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
seaweedfsseaweedfsbefore 4.344.34Patch availableCNA
—github.com/seaweedfs/seaweedfs (Go)before 0.0.0-20260612000715-b44cf51fe9310.0.0-20260612000715-b44cf51fe931Patch availableGHSA-56wq-x3wv-3ff4
  • seaweedfs Vendorseaweedfs Affected before 4.34 Fixed in 4.34 Patch available CNA
  • github.com/seaweedfs/seaweedfs (Go) Vendor— Affected before 0.0.0-20260612000715-b44cf51fe931 Fixed in 0.0.0-20260612000715-b44cf51fe931 Patch available GHSA-56wq-x3wv-3ff4

Remediation

  • Fix · CNA seaweedfs (seaweedfs) Fixed in 4.34
  • Fix · GHSA-56wq-x3wv-3ff4 github.com/seaweedfs/seaweedfs (Go) Fixed in 0.0.0-20260612000715-b44cf51fe931 Advisory →

Red Hat 1 advisory

  • RHSA-2026:68333 Released 2026-09-16 · Red Hat rating Important
    Red Hat build of Cryostat security update
    • Cryostat 4 on RHEL 9 cryostat/cryostat-agent-init-rhel9, cryostat/cryostat-grafana-dashboard-rhel9, cryostat/cryostat-openshift-console-plugin-rhel9 +5

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Cryostat 4 on RHEL 9Fixed RHSA-2026:68333
Not affected: 1 product
  • Cryostat 4 on RHEL 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-55874
  2. 2026-10-03 Alias added: GHSA-56wq-x3wv-3ff4

References

Advisory 1

Other 5

  • TI-2026-39686 SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access CVSS 4.0HIGH 7.8
  • TI-2026-53965 SeaweedFS: SFTP path ACL literal prefix match permits cross-tenant file read and overwrite CVSS 3.1HIGH 8.1
  • TI-2024-26879 seaweedfs v3.68 was discovered to contain a SQL injection vulnerability via the component… CVSS 3.1MEDIUM 6.5
  • TI-2026-42003 SeaweedFS < 4.34 - Cross-Bucket Object Deletion via DeleteObjects Request-Body Keys CVSS 4.0HIGH 7.2
  • TI-2026-74336 Hard-coded SSH host key in SeaweedFS SFTP Helm chart CVSS 4.0HIGH 7.0
  • TI-2026-54097 Incorrect authorization in seaweedfs CVSS 3.1HIGH 7.1
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences