Denis Abashkin

**Name of the Vulnerable Software and Affected Versions** SeaweedFS versions prior to 4.30 **Description** The S3 API gateway and the Iceberg REST catalog gateway use a router configuration that disables path cleaning. This allows a `..` segment within a URL to persist during routing. For example, a request to `GET /bucket-A/../evil-bucket/key` is processed as `bucket=bucket-A` and `object=../evil-bucket/key`. The object key is subsequently processed by `util.JoinPath()` in S3 or `path.Join()` in Iceberg, which collapses the `..` segment on the server side, enabling unauthorized cross-bucket access for read or write operations. **Recommendations** Update to version 4.30.