CVE-2026-55874

SeaweedFS: Path traversal in the S3 gateway X-Amz-Copy-Source header allows cross-bucket object read

View on CVE.org
Published Jul 8, 2026 CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Description
SeaweedFS is a distributed storage system. Prior to 4.34, the S3 API gateway does not reject dot-dot path segments in the X-Amz-Copy-Source header used by CopyObject and UploadPartCopy, allowing an authenticated identity scoped to one bucket to read objects from other buckets through server-side copy. This issue is fixed in version 4.34.

Analysis

AI-generated

Technical impact

SeaweedFS, a distributed storage system, contains a path‑traversal vulnerability in its S3 gateway. The X‑Amz‑Copy‑Source header used by CopyObject and UploadPartCopy accepts dot‑dot path segments without validation. An authenticated identity scoped to a single bucket can craft a copy request that reads objects from any other bucket, exposing data that the attacker should not have access to. The directory traversal flaw (CWE‑22).

Affected Systems

SeaweedFS is impacted in all releases before vulnerability is fixed in release 4.34 and later SeaweedFS running a version older than 4.34 that exposes the S3 API is affected.

Risk and Exploitability

The vulnerability has a CVSS score of 7.7, indicating a medium‑to‑high risk. The EPSS score is < 1%. It is not listed in the CISA KEV catalog. Exploitation requires a valid authenticated S3 CopyObject or UploadPartCopy operations. The X‑Amz‑Copy‑Source header can be used to read objects in other buckets, resulting in confidentiality loss. No additional permissions or elevated privileges are required beyond normal access to the source bucket.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade SeaweedFS to version 4.34 or later, which removes the path‑traversal bug in the S3 possible, enforce path validation to reject X‑Amz‑Copy‑Source headers containing dot‑dot segments, mitigating the CWE‑22 path traversal flaw.
  • Review so that users have the minimal required access, reducing the attack surface for cross‑bucket data reads.
  • If upgrading is not immediately possible, block the X‑Amz‑Copy‑Source header to prevent copy operations until a patch is applied.

Generated by OpenCVE AI on August 1, 2026 at 16:12 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Github GHSA Github GHSA GHSA-56wq-x3wv-3ff4 SeaweedFS: Path traversal in the S3 gateway X-Amz-Copy-Source header allows cross-bucket object read
History
Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Important
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Seaweedfs
Seaweedfs seaweedfs
Vendors & Products Seaweedfs
Seaweedfs seaweedfs
Type Values Removed Values Added
Description SeaweedFS is a distributed storage system. Prior to 4.34, the S3 API gateway does not reject dot-dot path segments in the X-Amz-Copy-Source header used by CopyObject and UploadPartCopy, allowing an authenticated identity scoped to one bucket to read objects from other buckets through server-side copy. This issue is fixed in version 4.34.
Title SeaweedFS: Path traversal in the S3 gateway X-Amz-Copy-Source header allows cross-bucket object read
Weaknesses CWE-22
References
Metrics cvssV3_1

{'score': 7.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N'}
Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Sources

Status
PUBLISHED
Assigner
GitHub_M
Published
Updated
Jul 8, 2026, 5:01 PM
Reserved
Jun 17, 2026, 4:59 PM

View source JSON

Updated
Jul 8, 2026, 4:52 PM

JSON

Status
Deferred
Published
Jul 8, 2026, 3:16 PM
Modified
Jul 8, 2026, 6:16 PM

View source JSON

Severity
Important
Public date
Jul 8, 2026, 2:43 PM

View source Bugzilla JSON

Updated
Aug 1, 2026, 4:15 PM

JSON