CVE-2026-55874: SeaweedFS S3 Gateway Path Traversal – Unauthorized Cross-Bucket Data Access

Technical summary

The S3 API gateway in SeaweedFS fails to sanitize directory traversal sequences (../) in the X-Amz-Copy-Source header, a parameter used to specify the source object location during server-side copy operations. When a client initiates a CopyObject or UploadPartCopy request, the gateway accepts relative paths containing dot-dot segments without proper validation, enabling traversal outside the intended bucket scope. An authenticated user with Identity and Access Management (IAM) credentials scoped to BucketA can craft a copy request referencing an object in BucketB, and the gateway will honor the request. This represents a classic path traversal (CWE-22) flaw exploiting insufficient input validation. The issue is resolved in version 4.34 through proper path normalization and validation of the copy-source parameter.

Business impact

This vulnerability directly compromises data confidentiality in multi-tenant SeaweedFS deployments. Organizations relying on bucket-level access controls to isolate data between tenants, departments, or customers face unauthorized data exposure. An insider or compromised service account can exfiltrate sensitive objects across bucket boundaries without triggering expected access denial events. For managed storage services or shared infrastructure environments, this violates the trust model and could result in compliance violations (GDPR, HIPAA, SOC 2), customer notification obligations, and reputational damage. The attack leaves minimal audit trail friction since the request originates from a legitimately authenticated identity.

Affected systems

SeaweedFS versions prior to 4.34 are affected. The vulnerability is specific to the S3 API gateway component; direct file system access or other access methods are not impacted by this particular flaw. Organizations running SeaweedFS as an S3-compatible storage backend (including Kubernetes environments, cloud deployments, or on-premises clusters) should verify their deployment version immediately. The vulnerability requires authentication, so only deployments with active S3 API access and multi-bucket configurations face direct risk.

Exploitability

Exploitation requires valid S3 API credentials (low barrier for insiders or compromised accounts) and knowledge of target object names or paths. The attack is straightforward: modify the X-Amz-Copy-Source header to include path traversal sequences and invoke standard S3 copy operations available in any S3 SDK or CLI tool. No specialized tools, race conditions, or user interaction are needed. Network accessibility to the S3 API gateway is required. The CVSS score of 7.7 reflects high exploitability (network-accessible, low attack complexity, low privileges required to trigger, but high impact limited to confidentiality). The vulnerability does not enable modification or deletion of objects, only unauthorized read access.

Remediation

Upgrade SeaweedFS to version 4.34 or later, which includes proper validation and normalization of the X-Amz-Copy-Source header. Organizations should prioritize this update in environments where multiple tenants or security zones share a single SeaweedFS cluster. After patching, conduct a retroactive audit to detect any suspicious copy operations targeting objects outside expected bucket scopes by reviewing S3 API logs and access patterns. Consider implementing least-privilege S3 IAM policies to further reduce the blast radius of compromised credentials.

Patch guidance

Apply SeaweedFS version 4.34 or later. Consult the SeaweedFS release notes and deployment documentation for upgrade procedures specific to your deployment model (standalone, Kubernetes, Docker). Test the upgrade in a non-production environment first to ensure compatibility with your storage schema and client applications. The patch includes input validation enhancements with no known breaking changes to the S3 API surface. If you operate a managed SeaweedFS service or distribution, contact your vendor for availability and timing.

Detection guidance

Monitor S3 API audit logs for CopyObject and UploadPartCopy requests with X-Amz-Copy-Source headers containing ../ sequences or unusual cross-bucket references. Correlate copy requests with the source and destination buckets to identify out-of-policy access patterns. Set alerts on copy operations that reference buckets outside a user's documented scope. Review CloudTrail logs (if SeaweedFS is integrated with cloud audit systems) or native SeaweedFS access logs for anomalous copy activity. In Kubernetes environments, monitor object storage operator logs for unexpected S3 gateway behavior. Conduct a one-time audit of recent copy operations to identify any successful unauthorized reads that may have already occurred.

Why prioritize this

This vulnerability merits immediate patching due to the combination of high confidentiality impact, ease of exploitation, and breach of a critical security boundary (bucket isolation). In multi-tenant or regulated environments, unauthorized data access across security zones represents a material risk. The low attack complexity and authentication-only requirement mean that insider threats and credential compromise scenarios pose realistic attack vectors. Although not yet listed in the CISA KEV catalog, the severity and exploitability profile warrant urgent remediation.

Risk score, explained

The CVSS 3.1 score of 7.7 (HIGH) reflects: (1) Network-accessible attack vector with no geographic or network segmentation required; (2) Low attack complexity—standard S3 operations suffice; (3) Low privileges required, but authentication is mandatory; (4) High confidentiality impact, as any object in any bucket becomes readable; (5) Scope change, as the impact crosses security boundaries (bucket isolation); (6) No integrity or availability impact. The score appropriately emphasizes the data confidentiality breach while acknowledging the authentication prerequisite.

Frequently asked questions