CriticalFix available

SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access

Type: advisorySource: OSV1 source record

SeaweedFS is a distributed storage system for object storage (S3), file systems, and Iceberg tables. Prior to 4.30, the S3 API gateway and the Iceberg REST catalog gateway construct their routers with mux.NewRouter().SkipClean(true). With path cleaning disabled, a .. segment inside the URL survives routing, so a request such as `GET /bucket-A/../evil-bucket/key`, is matched as bucket=bucket-A, object=../evil-bucket/key. The captured object key is then joined into a filer path with util.JoinPath (S3) / path.Join (Iceberg), which collapse the .. server-side, so the actual read or write lands in evil-bucket. This vulnerability is fixed in 4.30.

Announced 30 Jun 2026Source revision 1

Original source ↗

BIT-seaweedfs-2026-54917

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:BIT-seaweedfs-2026-54917

seaweedfs

Source reference: /affected/0/package/name

Affected versions: Not stated in this record
Fixed versions: 4.30.0
Source reference: /affected/0/ranges
Prerequisites: Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "4.30.0"
          }
        ]
      }
    ],
    "package": {
      "name": "seaweedfs",
      "purl": "pkg:bitnami/seaweedfs",
      "ecosystem": "Bitnami"
    },
    "severity": [
      {
        "type": "CVSS_V3",
        "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N"
      }
    ],
    "database_specific": {
      "source": "https://github.com/bitnami/vulndb/tree/main/data/seaweedfs/BIT-seaweedfs-2026-54917.json"
    }
  }
]