HIGH 7.7 GitHub
CVE-2026-55874
SeaweedFS: Path traversal in the S3 gateway X-Amz-Copy-Source header allows cross-bucket object read
### Summary
The SeaweedFS S3 API gateway did not reject `..` path segments in the `X-Amz-Copy-Source` header used by `CopyObject` and `UploadPartCopy`. The request URL path was hardened against traversal in 4.30 (CVE-2026-54917), but the copy-source header was only checked for emptiness, so a `..` segment in the copy source survived into the server-side filer path and resolved into a different bucket.
### Impact
A confused-deputy authorization bypass that breaks bucket isolation. IAM evaluates
Affected Products
- go/github.com/seaweedfs/seaweedfs < 0.0.0-20260612000715-b44cf51fe931
References
- https://github.com/advisories/GHSA-56wq-x3wv-3ff4
- https://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-56wq-x3wv-3ff4
- https://nvd.nist.gov/vuln/detail/CVE-2026-55874
- https://github.com/seaweedfs/seaweedfs/pull/9929
This high severity vulnerability with a CVSS score of 7.7 was published on 2026-08-28 via GitHub. Affected: go/github.com/seaweedfs/seaweedfs < 0.0.0-20260612000715-b44cf51fe931.
vulnfeed aggregates 11507 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.