SeaweedFS, a distributed storage system, contains a path‑traversal vulnerability in its S3 gateway. The X‑Amz‑Copy‑Source header used by CopyObject and UploadPartCopy accepts dot‑dot path segments without validation. An authenticated identity scoped to a single bucket can craft a copy request that reads objects from any other bucket, exposing data that the attacker should not have access to. The directory traversal flaw (CWE‑22).

SeaweedFS is impacted in all releases before vulnerability is fixed in release 4.34 and later SeaweedFS running a version older than 4.34 that exposes the S3 API is affected.

The vulnerability has a CVSS score of 7.7, indicating a medium‑to‑high risk. The EPSS score is < 1%. It is not listed in the CISA KEV catalog. Exploitation requires a valid authenticated S3 CopyObject or UploadPartCopy operations. The X‑Amz‑Copy‑Source header can be used to read objects in other buckets, resulting in confidentiality loss. No additional permissions or elevated privileges are required beyond normal access to the source bucket.