CVE-2026-77368: SeaweedFS: Authenticated Cross-Prefix IDOR in Filer TUS Handler Enables Arbitrary Write to Tenant-Forbidden Paths
SeaweedFS is a distributed storage system for files and blobs. In version 4.39, the filer's TUS resumable-upload handler checks JWT allowedprefixes scoping only when a session is created, letting a low-privilege tenant hijack another tenant's upload session to write content to filer paths their own token forbids. The HEAD, PATCH, and DELETE verbs that act on an existing session by its id never verify that the session's stored target path falls within the caller's allowed prefixes, so a tenant who obtains another upload's session identifier can PATCH attacker bytes into it and, on completion, have the file land at the victim's out-of-scope path. The same token can also DELETE other tenants' sessions and HEAD them to read upload progress and size, defeating the JWT prefix isolation. This vulnerability only affects deployments that configure filer JWT signing and have TUS uploads enabled. This issue is fixed in version 4.40.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SeaweedFS filer TUS resumable-upload handlerto a version that resolves this vulnerability.Fixed in 4.40 - Compensating control
For SeaweedFS deployments with TUS uploads enabled and filer JWT signing configured, treat possession of other tenants’ TUS session identifiers as high risk; ensure TUS upload session identifiers cannot be obtained by low-privilege tenants (e.g., prevent cross-tenant exposure of TUS session IDs via application/authz controls).
Event History
Frequently Asked Questions
Which deployments are affected?
Only deployments with filer JWT signing configured and TUS resumable uploads enabled are affected. The issue is present in SeaweedFS version 4.39 and is fixed in version 4.40.
What does an attacker need to exploit this issue?
An attacker needs a low-privilege tenant JWT and the identifier of another tenant's existing TUS upload session. No user interaction is required.
What can an attacker do with a victim upload session identifier?
They can PATCH data into the session so that, when it completes, content is written to the victim's path outside the attacker's permitted prefixes. They can also DELETE the session or use HEAD to view its upload progress and size.
What should be done if an immediate upgrade is not possible?
The provided data identifies JWT signing combined with enabled TUS uploads as the affected configuration. Disabling TUS uploads or avoiding that affected combination can remove the described exposure until SeaweedFS can be updated to version 4.40.