CVE-2026-77317: SeaweedFS: SFTP path ACL literal prefix match permits cross-tenant file read and overwrite
SeaweedFS is a distributed storage system for files and blobs. In versions from 3.88 through 4.39, the SFTP server evaluates configured path permissions with a literal string-prefix comparison, so a user scoped to a path is also granted the same access to any sibling path whose name merely begins with the same characters. A user granted access to /tenants/alice therefore also matches /tenants/alice-archive, /tenants/alice2, and similar siblings, because the check does not require a path-component boundary. An authenticated low-privilege SFTP user with a root home directory and narrow path permissions can thereby cross the configured ACL boundary to read another tenant's files, and to overwrite them if granted write, all through the documented SFTP service with its own valid credentials. This issue is fixed in version 4.40.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SeaweedFSto a version that resolves this vulnerability.Fixed in 4.40
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
SeaweedFS versions 3.88 through 4.39 are affected where the SFTP service is used with authenticated users that have a root home directory and path-scoped permissions. The risk applies when a permitted path has sibling paths sharing its literal prefix, such as /tenants/alice and /tenants/alice-archive.
What does an attacker need to exploit it?
An attacker needs valid credentials for a low-privilege SFTP user whose configured access is limited to a path. No user interaction is required, and exploitation occurs through the documented SFTP service.
What access could an attacker gain?
The attacker can read files in sibling paths whose names begin with the authorized path string, despite those paths being outside the intended ACL boundary. If the user has write permission, the attacker can also overwrite files in those matching sibling paths.
How can I remediate the issue?
Upgrade SeaweedFS to version 4.40, which fixes the path-permission matching behavior. If an upgrade cannot occur immediately, review SFTP path permissions for literal-prefix collisions between tenant or other sibling directory names.