CVE-2026-55874: SeaweedFS Path Traversal Vulnerability

CVE-2026-55874 Overview

CVE-2026-55874 is a path traversal vulnerability in SeaweedFS, a distributed storage system. The S3 API gateway fails to reject dot-dot (..) path segments in the X-Amz-Copy-Source header used by the CopyObject and UploadPartCopy operations. An authenticated identity scoped to a single bucket can abuse the server-side copy path to read objects from other buckets outside its intended scope. The flaw is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). SeaweedFS version 4.34 fixes the issue.

Critical Impact
Authenticated tenants scoped to one bucket can read objects from other tenants' buckets through server-side S3 copy operations, breaking multi-tenant isolation.

Affected Products

SeaweedFS distributed storage system versions prior to 4.34
SeaweedFS S3 API gateway component handling CopyObject requests
SeaweedFS S3 API gateway component handling UploadPartCopy requests

Discovery Timeline

2026-07-08 - CVE-2026-55874 published to NVD
2026-07-08 - Last updated in NVD database
Version 4.34 - SeaweedFS releases patched version, see GitHub Release 4.34

Technical Details for CVE-2026-55874

Vulnerability Analysis

SeaweedFS exposes an S3-compatible API gateway that supports the standard CopyObject and UploadPartCopy operations. Both operations rely on the X-Amz-Copy-Source HTTP header to identify the source object. The gateway performs authorization based on the bucket name it parses from this header. However, the parser does not normalize or reject .. segments before enforcing bucket scope checks.

An attacker holding valid credentials for one bucket can craft an X-Amz-Copy-Source value containing dot-dot segments that traverse outside the authorized bucket. The authorization layer sees the declared bucket, while the underlying resolver walks the path and returns an object stored in a different bucket. This yields cross-tenant read access through server-side copy.

The impact is limited to confidentiality. The vulnerability enables reads across bucket boundaries but does not grant write or delete capability, and the operation runs with authenticated credentials over the network.

Root Cause

The root cause is missing path canonicalization in the S3 gateway's handling of X-Amz-Copy-Source. The gateway trusts the declared source path without collapsing traversal sequences before applying bucket-scoped access control. This mismatch between the authorization view and the resolver view enables the bypass. Details are documented in GHSA-56wq-x3wv-3ff4.

Attack Vector

Exploitation requires an authenticated S3 identity scoped to at least one bucket in the SeaweedFS deployment. The attacker sends a PUT request implementing CopyObject or UploadPartCopy, and sets the X-Amz-Copy-Source header to a value containing .. segments that escape the authorized bucket namespace. The gateway performs the copy, returning content sourced from an unauthorized bucket. Review the upstream patch commit and pull request #9929 for the reference fix.

Detection Methods for CVE-2026-55874

Indicators of Compromise

S3 gateway access logs showing PUT requests with X-Amz-Copy-Source header values containing .. sequences or URL-encoded variants such as %2e%2e.
CopyObject or UploadPartCopy operations where the resolved source bucket differs from the bucket claimed in the authenticated identity's scope.
Unexpected cross-bucket read patterns from a single access key targeting objects it does not normally access.

Detection Strategies

Parse SeaweedFS S3 gateway logs and flag any X-Amz-Copy-Source values containing .., %2e%2e, or nested slash sequences.
Correlate the authenticated identity's authorized buckets with the actual source bucket resolved during copy operations, alerting on mismatches.
Baseline normal copy activity per identity and detect anomalous spikes in cross-bucket copy volume.

Monitoring Recommendations

Enable verbose access logging on the SeaweedFS S3 gateway and forward logs to a centralized analytics platform.
Monitor egress from SeaweedFS storage nodes for unusual data transfer volumes tied to authenticated tenants.
Track upgrade status of all SeaweedFS instances and alert on any node still running versions prior to 4.34.

How to Mitigate CVE-2026-55874

Immediate Actions Required

Upgrade all SeaweedFS deployments to version 4.34 or later using the official release.
Rotate S3 access keys for any tenants suspected of abusing CopyObject or UploadPartCopy prior to patching.
Audit S3 gateway logs for historical X-Amz-Copy-Source values containing traversal sequences and investigate matches.

Patch Information

SeaweedFS version 4.34 rejects dot-dot path segments in the X-Amz-Copy-Source header before performing authorization and resolution. The fix is delivered in commit b44cf51 and merged via PR #9929. Operators should deploy the upgrade across all gateway and filer nodes.

Workarounds

If immediate patching is not possible, place a reverse proxy in front of the S3 gateway and reject requests where the X-Amz-Copy-Source header contains .. or %2e%2e sequences.
Restrict issuance of scoped S3 credentials to trusted tenants until the upgrade is applied.
Isolate sensitive buckets on separate SeaweedFS clusters to reduce the blast radius of cross-tenant reads.

bash

# Example NGINX rule to block traversal in X-Amz-Copy-Source until upgrade
if ($http_x_amz_copy_source ~* "(\.\.|%2e%2e)") {
    return 400;
}