SeaweedFS SFTP servers from versions 3.88 through 4.39 evaluate file‑path permissions by performing a simple literal string‑prefix comparison. The check does not enforce a component boundary, so a user granted access to a specific path also inherits permission for any other path that merely begins with the same characters. As a result, an authenticated low‑privilege SFTP user who normally has limited access to /tenants/alice can also read and potentially overwrite files in /tenants/alice‑archive or /tenants/alice2. The vulnerability allows cross‑tenant data exposure and modification while using the legitimate credentials of the interactive SFTP client.

The affected product is SeaweedFS, distributed across its open source implementation. The issue spans all releases from 3.88 to 4.39 inclusive. Users running any of those versions should consider the SFTP service as a vector for unauthorized data access. Version 4.40 and later contain a patch that corrects the prefix‑match logic so that only exact component matches grant access.

The CVSS score of 8.1 indicates high severity with a strong impact on confidentiality and integrity. The EPSS score is not available, but the lack of an EPSS point does not negate the potential for exploitation; the vulnerability remains functional and exploitable when an SFTP user is authenticated. The issue is not yet listed in the CISA KEV catalog, yet the attack surface is present in any SeaweedFS deployment that exposes the SFTP service to users with a root home directory. The likely attack vector is an authenticated low‑privilege SFTP user who performs file operations in a directory that shares a common prefix with another tenant’s path. Exploitation requires only legitimate credentials and no additional privilege escalation.