CVE-2026-77763: JuiceFS Local Filestore Backend Joins Object Keys onto the Storage Root Without a Containment Check, Allowing Writes Outside the Configured Directory
The filestore backend in pkg/object/file.go, used for file:// stores and as a common juicefs sync destination, derived every operation's target from path(key), which returned either filepath.Join(d.root, key) or filepath.Clean(d.root + key) with no check that the result stayed beneath the root. Put, Get, Head, Delete, Chmod, Chown, Symlink and Readlink all consumed that value directly. Object keys enumerated from a source object store during a sync are not constrained the way local filesystem names are, so a key containing traversal segments causes juicefs to write attacker-supplied content to a path outside the intended local destination, and no error is returned. An operator syncing from a bucket whose contents they do not fully control, such as a shared or public bucket or one an attacker can write to, is therefore exposed to a file write at an attacker-influenced location. The fix changes path() to return an error and rejects any key whose resolved path escapes the root.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using JuiceFS file:// stores or using the filestore backend as a sync destination are exposed when they sync from an object store whose keys are not fully trusted. This includes shared or public buckets, or buckets where an attacker can create objects.
What does an attacker need to exploit this?
An attacker needs the ability to place an object with traversal segments in its key in a source object store that an operator syncs to a local filestore destination. No authentication or privileges on the destination host are described, but exploitation requires the operator to perform the sync and interact with the malicious content.
What is the impact of a malicious object key?
A traversal-containing key can cause attacker-supplied content to be written outside the configured local destination directory. The affected path handling is used by Put, Get, Head, Delete, Chmod, Chown, Symlink, and Readlink operations, and the vulnerable behavior returns no error for an escaping path.
What mitigation is available before updating?
Do not sync untrusted, shared, or public object-store contents to a file:// or filestore destination. Restrict write access to source buckets and ensure their object keys cannot contain traversal segments.