PT-2026-56468 · Seaweedfs · Seaweedfs

Published 2026-07-08 · Updated 2026-07-08 · CVE-2026-55874

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SeaweedFS versions prior to 4.34

Description The S3 API gateway fails to properly validate input in the X-Amz-Copy-Source header used by the CopyObject and UploadPartCopy functions. This improper validation allows the use of dot-dot path segments, leading to a path traversal condition during server-side copy source parsing. Consequently, an authenticated user restricted to a single bucket can craft requests to read and copy objects from other buckets, resulting in unauthorized data access and the breach of tenant isolation.

Recommendations Update to version 4.34.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-55874

Affected Products

Seaweedfs

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-55874 · Security Note
• https://github.com/seaweedfs/seaweedfs/releases/tag/4.34 · Note
• https://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-56wq-x3wv-3ff4 · Note
• https://github.com/seaweedfs/seaweedfs/commit/b44cf51fe931bd75aa4d37ae766bea90d7f85ccd · Note
• https://github.com/seaweedfs/seaweedfs/pull/9929 · Note
• https://twitter.com/UpwindMDR/status/2074909216989413603 · Twitter Post