DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-54917: CVE-2026-54917: Cross-Bucket Path Traversal and Authorization Bypass in SeaweedFS S3 and Iceberg Gateways

#security #cve #cybersecurity

CVE-2026-54917: Cross-Bucket Path Traversal and Authorization Bypass in SeaweedFS S3 and Iceberg Gateways

Vulnerability ID: CVE-2026-54917
CVSS Score: 10.0
Published: 2026-08-12

CVE-2026-54917 is a critical path traversal and authorization bypass vulnerability affecting the S3 and Iceberg REST catalog gateways in SeaweedFS. By explicitly disabling canonical path cleaning in the gorilla/mux routing system, relative path segments such as '..' are allowed to bypass routing constraints and access control checks. When these paths are collapsed server-side by the backend filer, they resolve to folders outside the authorized bucket boundary, allowing unauthorized cross-bucket access.

TL;DR

SeaweedFS gateways disable routing path cleaning, allowing '..' segments to reach the backend. This permits users with access to a single bucket to bypass IAM boundaries and read/write files in any other bucket on the cluster.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-22
  • Attack Vector: Network
  • CVSS Score: 10.0
  • Exploit Status: Proof-of-Concept Available
  • CISA KEV Status: Not Listed

Affected Systems

  • SeaweedFS S3 API Gateway
  • SeaweedFS Iceberg REST Catalog Gateway
  • SeaweedFS: < 4.30 (Fixed in: 4.30)

Code Analysis

Commit: dd1b428

Implement request path validation to reject relative path segments (..)

Exploit Details

Mitigation Strategies

  • Upgrade all SeaweedFS deployments to version 4.30 or later.
  • Disable multi-tenant environments if immediate patching is not possible.
  • Restrict S3 and Iceberg port access using host-based firewalls or network access control lists.

Remediation Steps:

  1. Audit existing deployments to locate all S3 API and Iceberg gateway configurations.
  2. Acquire the updated SeaweedFS package or container image (version 4.30 or higher).
  3. Apply the patch and restart the gateway services ('weed s3' or 'weed server').
  4. Verify remediation by attempting signed traversal requests and confirming they return HTTP 400.

References

Read the full report for CVE-2026-54917 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)