HIGH GitHub
CVE-2026-54917
SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access
## Summary
The S3 API gateway and the Iceberg REST catalog gateway construct their routers with `mux.NewRouter().SkipClean(true)`. With path cleaning disabled, a `..` segment inside the URL survives routing, so a request such as:
```
GET /bucket-A/../evil-bucket/key
```
is matched as `bucket=bucket-A`, `object=../evil-bucket/key`. The captured object key is then joined into a filer path with `util.JoinPath` (S3) / `path.Join` (Iceberg), which collapse the `..` server-side, so the actual read
Affected Products
- go/github.com/seaweedfs/seaweedfs < 0.0.0-20260526080459-dd1b4287899e
References
- https://github.com/advisories/GHSA-w62w-66v9-vvgv
- https://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-w62w-66v9-vvgv
- https://nvd.nist.gov/vuln/detail/CVE-2026-54917
- https://github.com/seaweedfs/seaweedfs/pull/9687
This high severity vulnerability was published on 2026-08-12 via GitHub. Affected: go/github.com/seaweedfs/seaweedfs < 0.0.0-20260526080459-dd1b4287899e.
vulnfeed aggregates 10542 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.