CVE-2026-55874

Name of the Vulnerable Software and Affected Versions SeaweedFS versions prior to 4.34

Description The S3 API gateway fails to properly validate input in the X-Amz-Copy-Source header used by the CopyObject and UploadPartCopy functions. This improper validation allows the use of dot-dot path segments, leading to a path traversal condition during server-side copy source parsing. Consequently, an authenticated user restricted to a single bucket can craft requests to read and copy objects from other buckets, resulting in unauthorized data access and the breach of tenant isolation.

Recommendations Update to version 4.34.