CVE-2026-54917 is a critical path traversal flaw (CVSS 10.0) in SeaweedFS before 4.30. The S3 and Iceberg REST gateways keep dot-dot segments in request paths, so a request can read or write an object in a different bucket than the one authorized. Upgrade to SeaweedFS 4.30.
What's affected
- SeaweedFS before 4.30, per the record.
- Fixed in 4.30.
- The S3 API gateway and the Iceberg REST catalog gateway. The advisory describes cross-bucket access with authentication off, and an authorization confusion with authentication on.
How to check if you're exposed
Check the version.
weed version
In containers, read the image tag. Then list where the S3 and Iceberg gateways are reachable, and whether authentication is enabled. Search the access logs of your gateways for request paths that contain dot-dot segments. Those entries deserve a closer look.
What to do now
- Upgrade SeaweedFS to 4.30 or later.
- Turn on authentication for the S3 gateway if it is off.
- Restrict network access to the gateways to the clients that need them.
- Search access logs for dot-dot segments in object paths, and review buckets for unexpected reads or writes.
Why it matters
The class is CWE-22, path traversal. The advisory explains that the routers ran with path cleaning disabled, so a segment like dot-dot stayed in the URL. The router then read the bucket name from one part of the path, while a later step joined the object key into a filer path and collapsed the dot-dot, landing in another bucket.
With authentication on, the policy check used the bucket named in the request path, so a caller allowed in one bucket was authorized and then acted on another. That mismatch between the checked value and the used value is the core flaw. The pull request rejects dot-dot in the path variables. The record does not mark the CVE as exploited in the wild.
For your own projects, the free in-browser dependency scan needs no install, and the Gold directory tracks this CVE.
Quick check
Does turning on authentication fix it?
No. The advisory describes an authorization confusion with authentication enabled. Upgrade.
Sources
- https://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-w62w-66v9-vvgv
- https://github.com/seaweedfs/seaweedfs/pull/9687
Last reviewed: 19 October 2026.
