Most recent entries from all

bdu:2026-11136

2026-10-10T18:27:13.929894+00:00

bdu:2026-11136

BIT-seaweedfs-2026-54917 — SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access

2026-10-10T18:27:13.929927+00:00

Affected: Bitnami: seaweedfs

SeaweedFS is a distributed storage system for object storage (S3), file systems, and Iceberg tables. Prior to 4.30, the S3 API gateway and the Iceberg REST catalog gateway construct their routers with mux.NewRouter().SkipClean(true). With path cleaning disabled, a .. segment inside the URL survives routing, so a request such as `GET /bucket-A/../evil-bucket/key`, is matched as bucket=bucket-A, object=../evil-bucket/key. The captured object key is then joined into a filer path with util.JoinPath (S3) / path.Join (Iceberg), which collapse the .. server-side, so the actual read or write lands in evil-bucket. This vulnerability is fixed in 4.30.

EUVD-2026-330387

2026-10-10T18:27:13.929961+00:00

EUVD-2026-330387

fkie_cve-2026-54917

2026-10-10T18:27:13.929975+00:00

GHSA-w62w-66v9-vvgv — SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access

2026-10-10T18:27:13.929999+00:00

Affected: Go: github.com/seaweedfs/seaweedfs

## Summary

The S3 API gateway and the Iceberg REST catalog gateway construct their routers with `mux.NewRouter().SkipClean(true)`. With path cleaning disabled, a `..` segment inside the URL survives routing, so a request such as:

``` GET /bucket-A/../evil-bucket/key ```

is matched as `bucket=bucket-A`, `object=../evil-bucket/key`. The captured object key is then joined into a filer path with `util.JoinPath` (S3) / `path.Join` (Iceberg), which collapse the `..` server-side, so the actual read or write lands in `evil-bucket`.

The captured path variables were never validated for traversal segments before reaching the handlers, so bucket isolation depended on downstream checks rather than on the path itself.

## Impact

- **With authentication disabled** (`enableAuth=false`): direct cross-bucket read and write. An object key containing `..` resolves to and operates on a different bucket than the one named in the request path. - **With authentication enabled** (`enableAuth=true`): an authorization confused-deputy. IAM evaluates the policy against the mux `{bucket}` variable (`bucket-A`) in `iam.authRequestWithAuthType`, while the I/O is performed against the traversed target (`evil-bucket`). A principal authorized for one bucket can therefore reach objects in another bucket it has no grant for. This breaks tenant isolation.

The same class of traversal applies to the Iceberg REST catalog's `{prefix}`, `{namespace}`, and `{table}` path variables.

`%2e%2e`-encoded and `..\` (b…