Seaweedfs

Seaweedfs

9 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
9.3

CVE-2026-73080

  • EPSS 0.38%
  • Veröffentlicht 11.08.2026 15:57:10
  • Zuletzt bearbeitet 13.08.2026 15:20:05

SeaweedFS is a distributed storage system. Prior to 4.24, VolumeServer.FetchAndWriteNeedle in weed/server/volume_grpc_remote.go fetches a caller-supplied remote endpoint through weed/remote_storage/s3/s3_storage_client.go and writes the response into...

8.1

CVE-2026-72921

  • EPSS 0.24%
  • Veröffentlicht 11.08.2026 14:28:49
  • Zuletzt bearbeitet 13.08.2026 16:19:03

SeaweedFS is a distributed storage system. Prior to 4.24, the weed/server/filer_server_handlers.go allowed_prefixes authorization check used strings.HasPrefix on raw path strings, so a filer JWT scoped to /tenant1 also authorized sibling paths such a...

9.8

CVE-2026-72920

  • EPSS 0.41%
  • Veröffentlicht 11.08.2026 14:23:22
  • Zuletzt bearbeitet 11.08.2026 15:17:38

SeaweedFS is a distributed storage system. Prior to 4.24, the filer registers the SeaweedIdentityAccessManagement gRPC service without mandatory authentication when jwt.filer_signing.key is unset, allowing any client that can reach the filer gRPC por...

4.3

CVE-2026-55873

  • EPSS 0.2%
  • Veröffentlicht 08.07.2026 14:48:37
  • Zuletzt bearbeitet 08.07.2026 16:16:31

SeaweedFS is a distributed storage system. In versions 4.08 through 4.33, requests signed with SigV4 service s3tables are routed to the S3Tables management API where authorization collapses account-less S3 identities into the shared admin account and...

7.7

CVE-2026-55874

  • EPSS 0.33%
  • Veröffentlicht 08.07.2026 14:43:40
  • Zuletzt bearbeitet 08.07.2026 18:16:33

SeaweedFS is a distributed storage system. Prior to 4.34, the S3 API gateway does not reject dot-dot path segments in the X-Amz-Copy-Source header used by CopyObject and UploadPartCopy, allowing an authenticated identity scoped to one bucket to read ...

8.1

CVE-2026-58372

Exploit
  • EPSS 0.77%
  • Veröffentlicht 30.06.2026 15:57:59
  • Zuletzt bearbeitet 14.07.2026 22:17:29

SeaweedFS before 4.34 contains a path traversal vulnerability in the S3 gateway DeleteMultipleObjectsHandler that allows authenticated S3 principals with write access to a single bucket to delete arbitrary objects in other tenants' buckets by supplyi...

3.1

CVE-2026-58371

Exploit
  • EPSS 0.21%
  • Veröffentlicht 30.06.2026 15:57:36
  • Zuletzt bearbeitet 14.07.2026 22:17:28

SeaweedFS before 4.30 reflects the callback query parameter verbatim into responses served with Content-Type application/javascript in the shared writeJson helper (weed/server/common.go), with no callback-name validation, no X-Content-Type-Options: n...

10

CVE-2026-54917

Exploit
  • EPSS 0.39%
  • Veröffentlicht 25.06.2026 18:41:19
  • Zuletzt bearbeitet 29.06.2026 21:21:10

SeaweedFS is a distributed storage system for object storage (S3), file systems, and Iceberg tables. Prior to 4.30, the S3 API gateway and the Iceberg REST catalog gateway construct their routers with mux.NewRouter().SkipClean(true). With path cleani...

6.5

CVE-2024-40120

Exploit
  • EPSS 0.25%
  • Veröffentlicht 16.05.2025 00:00:00
  • Zuletzt bearbeitet 17.06.2025 14:09:04

seaweedfs v3.68 was discovered to contain a SQL injection vulnerability via the component /abstract_sql/abstract_sql_store.go.