CVE Intelligence
Analysis AI-assisted

CVE-2026-54917: SeaweedFS S3 and Iceberg gateways path traversal

CVE-2026-54917 is a path traversal flaw in the S3 API and Iceberg REST catalog gateways of SeaweedFS before version 4.30. Because path cleaning is disabled in the router, parent-directory segments in object keys can redirect a request to another bucket. The record assigns a critical severity and states that the issue is fixed in 4.30.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

SeaweedFS is a distributed storage system that exposes object storage through an S3 API, file systems and Iceberg tables. According to the record, the S3 API gateway and the Iceberg REST catalog gateway build their routers with path cleaning disabled before version 4.30. This allows an object key containing parent-directory segments to be resolved outside the bucket named in the request.

Impact

The record classifies the issue as path traversal (CWE-22). A request routed to one bucket can read or write objects in another bucket once the object key is joined into a filer path. The NVD score is 10 under CVSS 3.1, with high confidentiality and integrity impact and no availability impact. The GitHub CNA score is 7.8 under CVSS 4.0. The real data exposure depends on deployment and bucket layout, which the record does not describe.

Affected products and versions

  • Product listed: Seaweedfs Seaweedfs.
  • Affected range listed: < 4.30.
  • Fixed version stated in the description: 4.30.
  • The record does not list individual earlier releases within the range.

Exploitation status

The CISA KEV catalog does not list this CVE according to the record, and no confirmed exploitation appears in the sources consulted. The GitHub advisory carries an Exploit tag in its reference metadata, but that tag alone does not confirm exploitation in the wild. EPSS and SSVC data are absent from the record.

Remediation and mitigation

  • Upgrade SeaweedFS to version 4.30 or later, the release the description identifies as fixed.
  • Read the GitHub security advisory for the vendor's guidance.
  • The record lists a mitigation reference in pull request 9687. Its content was not available for this analysis, so review it before using it as an interim control.
  • While upgrades are planned, restrict network access to the S3 and Iceberg REST gateways to trusted clients. This reduces exposure but is not a verified fix.

Detection guidance

  • Review gateway access logs for object paths containing parent-directory segments or resolving to a bucket different from the one named in the request.
  • Correlate unexpected cross-bucket reads or writes with identity and audit records.
  • Track the upgrade status of every SeaweedFS instance, including internal, test and development deployments.

Limitations of the available information

The record gives no technical reproduction details, no list of earlier releases beyond the < 4.30 range, no EPSS score and no SSVC decision. Whether a given deployment is reachable, and what data it holds, cannot be determined from the record.

Frequently asked questions

Is this vulnerability known to be exploited?

No confirmed exploitation appears in the sources consulted, and the record shows the CVE is not listed in the CISA KEV catalog.

Which version fixes the issue?

The record states that the vulnerability is fixed in SeaweedFS 4.30, so upgrading to that version or later addresses it according to the vendor description.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.