CVE-2026-58372: SeaweedFS S3 Path Traversal Cross-Tenant Data Deletion

Technical summary

The vulnerability exists in SeaweedFS versions prior to 4.34 within the DeleteMultipleObjectsHandler component of the S3 gateway. When a client sends a DeleteObjects XML request (the S3 API mechanism for batch deletion), the handler processes object keys from the request body without proper path validation. The validateRequestPath middleware inspects only URL-captured path variables and does not examine request-body content, creating a confused deputy condition. Attackers supply object keys containing ../ sequences, which the filer path resolution layer then collapses, allowing directory traversal outside the authorized bucket scope. This permits deletion of arbitrary objects in other tenants' buckets despite the authorization model restricting the principal to a single bucket.

Business impact

This vulnerability enables cross-tenant data destruction in multi-tenant SeaweedFS deployments, a critical concern for hosted storage platforms and cloud service providers. A malicious or compromised S3 application account can permanently delete other customers' data, violating data integrity guarantees and causing operational damage. Organizations relying on SeaweedFS for managed storage services face reputational harm, potential regulatory penalties (under data protection regulations), and service unavailability. The ease of exploitation—requiring only standard S3 API calls with crafted XML—lowers the barrier to malicious action.

Affected systems

SeaweedFS versions before 4.34 are affected. The vulnerability manifests specifically in deployments exposing the S3 gateway interface and operating in multi-tenant configurations where different principals have restricted bucket access. Systems running SeaweedFS 4.34 and later are not impacted, provided patches are applied from an uncompromised source.

Exploitability

Exploitation requires authentication—the attacker must possess valid S3 credentials with write access to at least one bucket. No network access restrictions are bypassed; the attack occurs over standard HTTPS S3 API calls. The technical bar is low: standard S3 client libraries or curl can construct the necessary DeleteObjects request with directory-traversal sequences in the XML body. The attack is deterministic and reliable; there is no race condition, timing dependency, or user interaction required. The primary control—URL-path validation—provides no defense because it does not inspect request bodies.

Remediation

Upgrade SeaweedFS to version 4.34 or later. The patch addresses the vulnerability by extending request validation to inspect object keys within DeleteObjects request bodies for path traversal sequences before processing deletions. Verify the upgrade path with your SeaweedFS distribution and test in a non-production environment to ensure compatibility with custom configurations or extensions. Organizations unable to upgrade immediately should restrict S3 gateway access via network controls (e.g., firewall rules, VPC restrictions) to trusted internal applications and consider implementing read-only S3 policies where write-access-to-delete patterns are not essential.

Patch guidance

Apply SeaweedFS 4.34 or a later maintenance release. Review vendor advisories for any additional security hardening recommendations accompanying the patch. If your environment uses a patched third-party distribution or fork of SeaweedFS, confirm that the backport includes fixes for both the validateRequestPath middleware and the DeleteMultipleObjectsHandler. Testing should verify that (1) legitimate multi-object deletions within a bucket continue to function, (2) cross-bucket deletion attempts are blocked, and (3) no S3 API compatibility regressions occur for other delete operations.

Detection guidance

Monitor S3 gateway logs for DeleteObjects requests containing unusual key patterns, particularly those with ../ or similar directory-traversal sequences in the request body. Alert on any deletion operations followed by errors indicating authorization failures or unexpected bucket scope changes. In multi-tenant environments, implement centralized logging for all S3 operations and correlate deletion activity across buckets; sudden deletions in buckets outside an application's permitted scope may indicate exploitation. Network-level detection is difficult because the attack uses standard HTTPS S3 API traffic; focus on application-layer logging and audit trails within SeaweedFS itself.

Why prioritize this

This vulnerability scores CVSS 8.1 (HIGH) due to the combination of low attack complexity, low privilege requirements (write access to one bucket), and severe impact (integrity violation and availability loss across tenants). While not as critical as remote unauthenticated code execution, the cross-tenant data destruction capability in multi-tenant deployments makes it a priority for cloud storage operators and service providers. Organizations operating single-tenant SeaweedFS instances may see lower urgency, but multi-tenant platforms should treat this as critical and patch immediately.

Risk score, explained

The CVSS 3.1 score of 8.1 reflects: (1) network-accessible attack vector (AV:N), (2) low attack complexity requiring only standard API calls (AC:L), (3) low privilege requirement—the attacker needs only valid S3 credentials with write access to one bucket (PR:L), (4) no user interaction (UI:N), (5) unchanged scope—the attack does not escalate to other systems (S:U), (6) no confidentiality impact (C:N), and (7) high integrity and availability impact (I:H, A:H) through deletion of arbitrary objects. The score appropriately reflects a serious authorization bypass that does not require privilege escalation or cross-system compromise but does enable significant data destruction within the affected platform.

Frequently asked questions