SeaweedFS before version 4.34 contains a path traversal flaw (CWE-22) in its S3 gateway DeleteMultipleObjectsHandler that allows an authenticated S3 principal with write permissions on one bucket to delete arbitrary objects located in other tenants’ buckets. The vulnerability is triggered by supplying object keys that include "../" sequences in the DeleteObjects XML request body, which the middleware ignores during path validation. This permits a confused‑deputy attack that bypasses bucket‑level authorization controls and results in the loss of data from unintended buckets.

The affected product is SeaweedFS. Users running SeaweedFS prior to the 4.34 release are vulnerable to this cross‑bucket object deletion flaw.

The CVSS score of 7.2 denotes a medium‑to‑high severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires only authenticated S3 access with write rights on a bucket; an attacker can craft a DeleteObjects request containing traversal sequences and delete objects from any other tenant’s bucket without needing additional privileges.