Path Traversal Vulnerability in SeaweedFS Distributed Storage System
CVE-2026-54917
Key Information:
Badges
What is CVE-2026-54917?
SeaweedFS, a distributed storage solution for object storage and Iceberg tables, has a vulnerability where specific URL patterns can bypass security measures. With the S3 API gateway and the Iceberg REST catalog gateway configured with path cleaning disabled, attackers can exploit this flaw using URLs that include .. segments. For example, a request such as GET /bucket-A/../evil-bucket/key can lead to unauthorized access or manipulation of files in unintended buckets. This risk is addressed in version 4.30, where the proper routing safeguard against such path traversal attacks is implemented.
Affected Version(s)
seaweedfs < 4.30
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.