JuiceFS Vulnerability in Local Filestore Backend

CVE-2026-77763

What is CVE-2026-77763?

The JuiceFS local filestore backend contains a vulnerability that allows for unauthorized file writes outside the intended directory. This occurs due to a lack of containment checks when resolving object keys, enabling attackers to supply malicious content that gets written directly to sensitive locations. The filestore backend's handling of paths during operations like synchronization from uncontrolled object stores leads to potential exploitation when paths escape the designated root. The vulnerability has been addressed in recent updates to ensure that any object key which resolves improperly is now rejected.

References