CVE-2026-55874: SeaweedFS: Path traversal in the S3 gateway X-Amz-Copy-Source header allows cross-bucket object read
SeaweedFS is a distributed storage system. Prior to 4.34, the S3 API gateway does not reject dot-dot path segments in the X-Amz-Copy-Source header used by CopyObject and UploadPartCopy, allowing an authenticated identity scoped to one bucket to read objects from other buckets through server-side copy. This issue is fixed in version 4.34.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SeaweedFS S3 API gatewayto a version that resolves this vulnerability.Fixed in 4.34
Event History
Frequently Asked Questions
What is the severity of CVE-2026-55874?
The severity of CVE-2026-55874 is rated as high with a score of 7.7.
How do I fix CVE-2026-55874?
To fix CVE-2026-55874, upgrade to SeaweedFS version 4.34 or later, where the vulnerability has been addressed.
What does CVE-2026-55874 allow attackers to do?
CVE-2026-55874 allows attackers to perform path traversal via the X-Amz-Copy-Source header, enabling them to read objects from unauthorized buckets.
Which software is affected by CVE-2026-55874?
CVE-2026-55874 affects SeaweedFS versions prior to 4.34.
Is authentication required to exploit CVE-2026-55874?
Yes, CVE-2026-55874 requires that the attacker has an authenticated identity scoped to one bucket to exploit the vulnerability.