CVE-2026-54917

Name of the Vulnerable Software and Affected Versions SeaweedFS versions prior to 4.30

Description The S3 API gateway and the Iceberg REST catalog gateway use a router configuration that disables path cleaning. This allows a .. segment within a URL to persist during routing. For example, a request to GET /bucket-A/../evil-bucket/key is processed as bucket=bucket-A and object=../evil-bucket/key. The object key is subsequently processed by util.JoinPath() in S3 or path.Join() in Iceberg, which collapses the .. segment on the server side, enabling unauthorized cross-bucket access for read or write operations.

Recommendations Update to version 4.30.