{"uuid": "06a998e3-9a9d-4a4e-a479-b3c9b0b3b0a7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54917", "type": "seen", "source": "https://gist.github.com/alon710/57586b5d8bd6ec2753b002d5acf877e5", "content": "# CVE-2026-54917: CVE-2026-54917: Cross-Bucket Path Traversal and Authorization Bypass in SeaweedFS S3 and Iceberg Gateways\n\n> **CVSS Score:** 10.0\n> **Published:** 2026-08-12\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54917\n\n## Summary\nCVE-2026-54917 is a critical path traversal and authorization bypass vulnerability affecting the S3 and Iceberg REST catalog gateways in SeaweedFS. By explicitly disabling canonical path cleaning in the gorilla/mux routing system, relative path segments such as '..' are allowed to bypass routing constraints and access control checks. When these paths are collapsed server-side by the backend filer, they resolve to folders outside the authorized bucket boundary, allowing unauthorized cross-bucket access.\n\n## TL;DR\nSeaweedFS gateways disable routing path cleaning, allowing '..' segments to reach the backend. This permits users with access to a single bucket to bypass IAM boundaries and read/write files in any other bucket on the cluster.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-22\n- **Attack Vector**: Network\n- **CVSS Score**: 10.0\n- **Exploit Status**: Proof-of-Concept Available\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- SeaweedFS S3 API Gateway\n- SeaweedFS Iceberg REST Catalog Gateway\n- **SeaweedFS**: < 4.30 (Fixed in: `4.30`)\n\n## Mitigation\n\n- Upgrade all SeaweedFS deployments to version 4.30 or later.\n- Disable multi-tenant environments if immediate patching is not possible.\n- Restrict S3 and Iceberg port access using host-based firewalls or network access control lists.\n\n**Remediation Steps:**\n1. Audit existing deployments to locate all S3 API and Iceberg gateway configurations.\n2. Acquire the updated SeaweedFS package or container image (version 4.30 or higher).\n3. Apply the patch and restart the gateway services ('weed s3' or 'weed server').\n4. Verify remediation by attempting signed traversal requests and confirming they return HTTP 400.\n\n## References\n\n- [https://nvd.nist.gov/vuln/detail/CVE-2026-54917](https://nvd.nist.gov/vuln/detail/CVE-2026-54917)\n- [https://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-w62w-66v9-vvgv](https://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-w62w-66v9-vvgv)\n- [https://github.com/seaweedfs/seaweedfs/pull/9687](https://github.com/seaweedfs/seaweedfs/pull/9687)\n- [https://github.com/seaweedfs/seaweedfs/commit/dd1b4287899eed3dfd73c2f3b1de001996fda229](https://github.com/seaweedfs/seaweedfs/commit/dd1b4287899eed3dfd73c2f3b1de001996fda229)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54917) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-12T22:31:56.548691Z"}