CVE-2026-77368

Name of the Vulnerable Software and Affected Versions SeaweedFS versions prior to 4.40

Description The filer's TUS resumable-upload handler fails to verify JWT allowed prefixes scoping after a session is created. This allows a low-privilege tenant who obtains another user's session identifier to hijack the upload session. Specifically, the HEAD, PATCH, and DELETE verbs do not verify if the session's target path is within the caller's allowed prefixes. Consequently, an attacker can use the PATCH verb to write unauthorized content to a victim's path, use the DELETE verb to remove other tenants' sessions, or use the HEAD verb to read upload progress and size, bypassing JWT prefix isolation. This issue only affects deployments with TUS uploads enabled and filer JWT signing configured.

Recommendations Update to version 4.40. As a temporary mitigation, disable TUS uploads or filer JWT signing if not strictly required.