Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

14 records

Vendor: seaweedfs Clear all filters
TI-2026-54097 CVE-2026-77611

Incorrect authorization in seaweedfs

Priority MEDIUM 64

SeaweedFS is a distributed storage system for files and blobs.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00384 Published 2026-08-26 Fixed in 4.40 CWE-863
TI-2026-40328 CVE-2026-55873 · GHSA-hgpf-8634-g44c

Incorrect authorization in seaweedfs

Priority LOW 20

SeaweedFS is a distributed storage system.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00342 Published 2026-07-08 Fixed in 4.34, 0.0.0-20260614205536-b13463880c1f CWE-863
TI-2026-42003 CVE-2026-58372 · GHSA-9cq9-w9qm-wc9p

SeaweedFS < 4.34 - Cross-Bucket Object Deletion via DeleteObjects Request-Body Keys

Priority HIGH 67

SeaweedFS before 4.34 contains a path traversal vulnerability in the S3 gateway DeleteMultipleObjectsHandler that allows authenticated S3 principals with write access to a single bucket to delete arbitrary objects in oth…

CVSS 4.0HIGH 7.2 Network Low privileges No interaction EPSS 0.00871 Published 2026-06-30 Fixed in 4.34 CWE-22
TI-2026-42002 CVE-2026-58371 · GHSA-7cpf-frp7-pm75

SeaweedFS < 4.30 - Cross-Origin Information Disclosure via Unvalidated JSONP callback Parameter

Priority MEDIUM 45

SeaweedFS before 4.30 reflects the callback query parameter verbatim into responses served with Content-Type application/javascript in the shared writeJson helper (weed/server/common.go), with no callback-name validation…

CVSS 4.0LOW 2.3 Network No auth User interaction EPSS 0.00333 Published 2026-06-30 Partial fix · 4.30 CWE-79