CVE-2026-55874: SeaweedFS: Path traversal in the S3 gateway X-Amz-Copy-Source header allows cross-bucket object read
The SeaweedFS S3 API gateway did not reject .. path segments in the X-Amz-Copy-Source header used by CopyObject and UploadPartCopy. The request URL path was hardened against traversal in 4.30 (CVE-2026-54917), but the copy-source header was only checked for emptiness, so a .. segment in the copy source survived into the server-side filer path and resolved into a different bucket.
References
- github.com/advisories/GHSA-56wq-x3wv-3ff4
- github.com/seaweedfs/seaweedfs/commit/b44cf51fe931bd75aa4d37ae766bea90d7f85ccd
- github.com/seaweedfs/seaweedfs/pull/9929
- github.com/seaweedfs/seaweedfs/releases/tag/4.34
- github.com/seaweedfs/seaweedfs/security/advisories/GHSA-56wq-x3wv-3ff4
- nvd.nist.gov/vuln/detail/CVE-2026-55874
Code Behaviors & Features
Detect and mitigate CVE-2026-55874 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →