123Chen-Jiahui

**Name of the Vulnerable Software and Affected Versions** SeaweedFS versions prior to 4.40 **Description** An authenticated S3 principal with permissions limited to a nested object key can overwrite an object outside their assigned scope. This occurs when calling the `PutObjectAcl` function on a permitted key. The handler validates the request against the nested key but incorrectly writes the updated entry to the bucket root instead of the key's parent directory. Consequently, the target object at the root is overwritten with the content, metadata, owner information, and Access Control List (ACL) of the scoped object, bypassing object-level action scoping configured via the static S3 identity file. **Recommendations** Update to version 4.40.