CVE-2026-58371

Name of the Vulnerable Software and Affected Versions SeaweedFS versions prior to 4.30

Description An issue exists where the callback query parameter is reflected verbatim into responses served with the Content-Type application/javascript in the shared writeJson() function (weed/server/common.go). This occurs due to a lack of callback-name validation, the absence of the X-Content-Type-Options: nosniff header, and the lack of a CORS allow-list. Consequently, JSON endpoints using writeJson() can be loaded cross-origin via a script tag, allowing third-party web pages to access sensitive information such as cluster topology, volume server URLs, gRPC ports, file identifiers, and directory listings. Affected endpoints include the unauthenticated master endpoints '/dir/status', '/dir/lookup', and '/cluster/status', the volume server '/status', and the filer directory listing. Additionally, because the callback string is reflected at the start of the body without a nosniff header, MIME-sniffing clients may interpret the reflected content as HTML.

Recommendations Update to version 4.30 or later.