Home

Description

SeaweedFS before 4.34 contains a path traversal vulnerability in the S3 gateway DeleteMultipleObjectsHandler that allows authenticated S3 principals with write access to a single bucket to delete arbitrary objects in other tenants' buckets by supplying object keys containing ../ sequences in the DeleteObjects XML request body. Attackers can bypass authorization controls through a confused deputy condition, as the validateRequestPath middleware only inspects URL-captured path variables and never examines request-body keys, allowing the filer path to collapse directory traversal sequences and resolve deletions outside the authorized bucket.

PUBLISHED Reserved 2026-06-30 | Published 2026-06-30 | Updated 2026-07-14 | Assigner VulnCheck




HIGH: 8.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

HIGH: 7.2CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Problem types

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Product status

Default status
unaffected

Any version before 4.34
affected

Credits

George Chen finder

References

github.com/...weedfs/security/advisories/GHSA-w62w-66v9-vvgv exploit

github.com/seaweedfs/seaweedfs/releases/tag/4.34 (Release Notes) release-notes

github.com/seaweedfs/seaweedfs/pull/9931 (Fix PR) related issue-tracking

github.com/...ommit/0345658ea8e7c6a3948ad190634b00866ec244c9 (Fix Commit) patch

github.com/...weedfs/security/advisories/GHSA-w62w-66v9-vvgv (Prior advisory (CVE-2026-54917) - incompletely fixed)

github.com/geo-chen/oss/blob/main/seaweedfs.md (Researcher Disclosure) technical-description exploit

www.vulncheck.com/...ion-via-deleteobjects-request-body-keys third-party-advisory

cve.org (CVE-2026-58372)

nvd.nist.gov (CVE-2026-58372)

Download JSON