CVE-2026-77763

Name of the Vulnerable Software and Affected Versions JuiceFS (affected versions not specified)

Description The filestore backend in pkg/object/file.go, used for file:// stores and as a common sync destination, fails to verify if the target path remains within the root directory. The path(key) function returns a path using filepath.Join(d.root, key) or filepath.Clean(d.root + key) without validating the result. Consequently, operations such as Put, Get, Head, Delete, Chmod, Chown, Symlink, and Readlink consume this value directly. When syncing from a source object store, keys containing traversal segments—sequences of characters used to access directories above the current one—can cause the software to write attacker-supplied content to locations outside the intended local destination. This exposes operators syncing from shared, public, or attacker-controlled buckets to unauthorized file writes at influenced locations.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.