Critical Path Traversal Flaw in SeaweedFS Exposes Sensitive Data Across Storage Buckets
Overview
CVE-2026-54917 represents a CVSS 10.0 vulnerability in SeaweedFS storage systems, enabling attackers to bypass bucket isolation via path traversal attacks. This flaw exposes enterprise and DIB environments to cross-bucket data exfiltration and unauthorized modifications.
Technical Analysis
The vulnerability stems from SeaweedFS' S3 and Iceberg gateways using a router configuration (mux.NewRouter().SkipClean(true)) that preserves URL-encoded path traversal sequences (e.g., ..). Attackers can craft requests like /bucket-A/../evil-bucket/key to exploit bucket path resolution logic, with server-side path normalization collapsing the traversal and writing/reading data to unintended buckets. Exploitation requires no authentication and can be triggered via standard API requests.
Enterprise & DIB Impact
Defense industrial base (DIB) organizations and enterprises leveraging SeaweedFS for sensitive storage could face catastrophic data leaks, including exposure of proprietary research, classified documents, or regulated datasets. The lack of authentication requirements amplifies risk for cloud storage deployments.
Recommended Actions
- Upgrade to SeaweedFS 4.30 immediately
- implement strict input validation for S3/Iceberg API requests
- monitor access logs for anomalous path patterns containing .. sequences
- enforce least-privilege bucket policies
- and conduct code reviews for similar path-handling vulnerabilities in custom storage implementations.
Need Help Assessing Your Exposure?
Axiom Cyber Research provides vulnerability assessment, red team operations, and security advisory services to the Defense Industrial Base and regulated sectors.
Schedule a ConsultationFull security advisory on 247alerts.net →