SeaweedFS’s S3 and Iceberg REST gateways allow path traversal that can redirect operations from one bucket to another by using a '..' segment in the request URL. The routers were created with path cleaning disabled, which lets the '..' component survive into the object key portion of the request. When the key is later resolved into a filer path, server‑side path normalization collapses the '..', causing the read or write to occur in the target bucket specified after the traversal. This flaw enables an attacker to read from or modify objects in buckets they should not have access to, thereby compromising confidentiality and integrity of stored data.

SeaweedFS, as supplied by seaweedfs:seaweedfs. All releases prior to version 4.30 are vulnerable; the issue was fixed in V4.30. Users running earlier versions of SeaweedFS with the S3 API gateway or the Iceberg REST catalog gateway should update to the patched release.

The CVSS score of 7.8 reflects a high‑impact vulnerability. EPSS data is not available, so the likelihood of exploitation remains unknown, but the issue is not listed in CISA’s KEV catalog. Based on the description, the attacker must send HTTP requests to the exposed S3 or Iceberg endpoints; authentication requirements are not specified, so it is reasonable to infer that the attack can be carried out as long as the gateway is reachable. The combination of a publicly exposed API and the ability to craft a malicious URL makes this vulnerability potentially exploitable by remote actors with basic network access.