Summary
SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access
The S3 API gateway and the Iceberg REST catalog gateway construct their routers with mux.NewRouter().SkipClean(true). With path cleaning disabled, a .. segment inside the URL survives routing, so a request such as:
GET /bucket-A/../evil-bucket/key
is matched as bucket=bucket-A, object=../evil-bucket/key. The captured object key is then joined into a filer path with util.JoinPath (S3) / path.Join (Iceberg), which collapse the .. server-side, so the actual read or write lands in evil-bucket.
The captured path variables were never validated for traversal segments before reaching the handlers, so bucket isolation depended on downstream checks rather than on the path itself.
Affected components
- S3 API gateway (
weed s3, and the S3 endpoint embedded inweed server) - Iceberg REST catalog gateway
Affected versions
All releases prior to 4.30.
Patched version
4.30 and later.
Proof of concept
With a bucket evil-bucket containing secret.txt, and a caller that only has (or needs no) access to bucket-A:
GET /bucket-A/../evil-bucket/secret.txt HTTP/1.1
Host: <gateway>
The response returns the contents of evil-bucket/secret.txt. The encoded form GET /bucket-A/%2e%2e/evil-bucket/secret.txt behaves identically.
Workarounds
For deployments that cannot upgrade immediately, place a reverse proxy in front of the gateway that normalizes the request path and rejects requests whose path contains .., %2e%2e, or backslash sequences. Note that disabling auth removes the only remaining barrier, so do not rely on enableAuth=false deployments being protected by anything.
Resources
- Fix: https://github.com/seaweedfs/seaweedfs/pull/9687 (commit
dd1b428)
Credits
Reported responsibly by Denis Abashkin (@dadbravo).
Impact
- With authentication disabled (
enableAuth=false): direct cross-bucket read and write. An object key containing..resolves to and operates on a different bucket than the one named in the request path. - With authentication enabled (
enableAuth=true): an authorization confused-deputy. IAM evaluates the policy against the mux{bucket}variable (bucket-A) iniam.authRequestWithAuthType, while the I/O is performed against the traversed target (evil-bucket). A principal authorized for one bucket can therefore reach objects in another bucket it has no grant for. This breaks tenant isolation.
The same class of traversal applies to the Iceberg REST catalog's {prefix}, {namespace}, and {table} path variables.
%2e%2e-encoded and ..\ (backslash) variants are equivalent, because gorilla/mux URL-decodes captured variables and NormalizeObjectKey folds \ to / before the path is used.
Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files. Typical impact: unauthorized file read or write outside the intended directory.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Upgrade to SeaweedFS 4.30 or later. The fix adds a validation middleware to both gateway routers that rejects any captured path variable containing a . or .. segment, a NUL byte, an embedded slash/backslash in single-segment slots, or an empty captured value, before any handler runs.
Frequently Asked Questions
- What is CVE-2026-54917? CVE-2026-54917 is a high-severity path traversal vulnerability in github.com/seaweedfs/seaweedfs (go), affecting versions < 0.0.0-20260526080459-dd1b4287899e. It is fixed in 0.0.0-20260526080459-dd1b4287899e. Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files.
- Which versions of github.com/seaweedfs/seaweedfs are affected by CVE-2026-54917? github.com/seaweedfs/seaweedfs (go) versions < 0.0.0-20260526080459-dd1b4287899e is affected.
- Is there a fix for CVE-2026-54917? Yes. CVE-2026-54917 is fixed in 0.0.0-20260526080459-dd1b4287899e. Upgrade to this version or later.
- Is CVE-2026-54917 exploitable, and should I be worried? Whether CVE-2026-54917 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-54917 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-54917? Upgrade
github.com/seaweedfs/seaweedfsto 0.0.0-20260526080459-dd1b4287899e or later.