Path Traversal Vulnerability in SeaweedFS by SeaweedFS
CVE-2026-77317

8.1HIGH

Key Information:

Vendor

Seaweedfs

Status
Seaweedfs
Vendor
CVE Published:
26 August 2026

What is CVE-2026-77317?

SeaweedFS, a distributed file storage system, is affected by a path traversal vulnerability in its SFTP server from versions 3.88 to 4.39. The server incorrectly evaluates configured path permissions using a simple string-prefix comparison, allowing an authenticated low-privilege user to circumvent access controls. For example, access granted to /tenants/alice may inadvertently extend to sibling paths such as /tenants/alice-archive or /tenants/alice2. This flaw enables unauthorized file access and potential overwriting of files owned by other tenants through legitimate SFTP credentials. The vulnerability is addressed in version 4.40, and users are encouraged to update promptly.

Affected Version(s)

seaweedfs >= 3.88, < 4.40

References

https://github.com/seaweedfs/seaweedfs/security/advisorie...
x_refsource_CONFIRM
https://github.com/seaweedfs/seaweedfs/commit/29981f8d24a...
x_refsource_MISC

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.