Read the docs
TI-2026-53981 Aliases CVE-2026-77368

SeaweedFS: Authenticated Cross-Prefix IDOR in Filer TUS Handler Enables Arbitrary Write to Tenant-Forbidden Paths

Priority LOW 33CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · High · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-639.

Summary

SeaweedFS is a distributed storage system for files and blobs. In version 4.39, the filer's TUS resumable-upload handler checks JWT allowed_prefixes scoping only when a session is created, letting a low-privilege tenant hijack another tenant's upload session to write content to filer paths their own token forbids. The HEAD, PATCH, and DELETE verbs that act on an existing session by its id never verify that the session's stored target path falls within the caller's allowed prefixes, so a tenant who obtains another upload's session identifier can PATCH attacker bytes into it and, on completion, have the file land at the victim's out-of-scope path. The same token can also DELETE other tenants' sessions and HEAD them to read upload progress and size, defeating the JWT prefix isolation. This vulnerability only affects deployments that configure filer JWT signing and have TUS uploads enabled. This issue is fixed in version 4.40.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00384 32nd percentileScored 2026-11-07
Fix Fixed seaweedfs (seaweedfs): 4.40

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
seaweedfsseaweedfs4.39 to before 4.404.40Patch availableCNA
  • seaweedfs Vendorseaweedfs Affected 4.39 to before 4.40 Fixed in 4.40 Patch available CNA

Remediation

  • Fix · CNA seaweedfs (seaweedfs) Fixed in 4.40

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-77368

References

Other 3

  • TI-2026-39686 SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access CVSS 4.0HIGH 7.8
  • TI-2026-53965 SeaweedFS: SFTP path ACL literal prefix match permits cross-tenant file read and overwrite CVSS 3.1HIGH 8.1
  • TI-2024-26879 seaweedfs v3.68 was discovered to contain a SQL injection vulnerability via the component… CVSS 3.1MEDIUM 6.5
  • TI-2026-42003 SeaweedFS < 4.34 - Cross-Bucket Object Deletion via DeleteObjects Request-Body Keys CVSS 4.0HIGH 7.2
  • TI-2026-74336 Hard-coded SSH host key in SeaweedFS SFTP Helm chart CVSS 4.0HIGH 7.0
  • TI-2026-54097 Incorrect authorization in seaweedfs CVSS 3.1HIGH 7.1
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences