cve.bz

CVE-2026-55874

7.7 highEPSS 0.6%

High (7.7). EPSS 0.6% chance of exploitation in the next 30 days. Fixed in github.com/seaweedfs/seaweedfs 0.0.0-20260612000715-b44cf51fe931.

SeaweedFS is a distributed storage system. Prior to 4.34, the S3 API gateway does not reject dot-dot path segments in the X-Amz-Copy-Source header used by CopyObject and UploadPartCopy, allowing an authenticated identity scoped to one bucket to read objects from other buckets through server-side copy. This issue is fixed in version 4.34.

Severity

CVSS 3.1

7.7 high
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
EPSS
0.6% chance of exploitation in the next 30 days; higher than 48% of CVEs (scores of 2026-10-31)
CWE
CWE-22
Published
Modified
Record from
the NVD, synced

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-56wq-x3wv-3ff4Gogithub.com/seaweedfs/seaweedfs<0.0.0-20260612000715-b44cf51fe9310.0.0-20260612000715-b44cf51fe931
GO-2026-6327Gogithub.com/seaweedfs/seaweedfs<0.0.0-20260612000715-b44cf51fe9310.0.0-20260612000715-b44cf51fe931

References

Check your stackJSON