CVE-2026-77317: SeaweedFS SFTP Auth Bypass Vulnerability

CVE-2026-77317 Overview

CVE-2026-77317 is an authorization vulnerability in SeaweedFS, a distributed storage system for files and blobs. The SFTP server evaluates configured path permissions using a literal string-prefix comparison instead of matching on path-component boundaries. An authenticated low-privilege SFTP user scoped to a path can access sibling paths whose names begin with the same characters. A user granted access to /tenants/alice also matches /tenants/alice-archive and /tenants/alice2. This enables cross-tenant file reads and, when write permission is granted, cross-tenant overwrites through the documented SFTP service. The issue affects versions 3.88 through 4.39 and is fixed in version 4.40. This vulnerability is classified as [CWE-863] Incorrect Authorization.

Critical Impact
Authenticated SFTP users can cross ACL boundaries to read and overwrite files belonging to other tenants sharing a common path prefix.

Affected Products

SeaweedFS versions 3.88 through 4.39
SeaweedFS SFTP server component (weed/sftpd)
Multi-tenant deployments using path-scoped SFTP permissions

Discovery Timeline

2026-08-26 - CVE-2026-77317 published to the National Vulnerability Database
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-77317

Vulnerability Analysis

SeaweedFS exposes an SFTP interface that enforces per-user path permissions defined in configuration. The permission check compared the requested path against the configured base path using a naive string-prefix operation. Because the check did not require a path-component boundary such as a trailing slash, any sibling directory whose name shared the configured prefix satisfied the comparison. An authenticated user granted access to /tenants/alice could operate on /tenants/alice-archive or /tenants/alice2 using the same credentials. The impact scales to any operation the user's ACL entry permits, including read and write. Because the exploit uses the documented protocol with valid credentials, the activity appears as legitimate SFTP traffic in service logs.

Root Cause

The function isPathInHomeDirectory in weed/sftpd/sftp_permissions.go invoked strings.HasPrefix(path, user.HomeDir) directly. String prefix matching does not respect the / separator that delimits path components. The identical flaw applied to path-scoped ACL entries evaluated by the SFTP permission logic.

Attack Vector

An authenticated low-privilege SFTP user connects to the SeaweedFS SFTP endpoint using valid credentials. The attacker issues standard SFTP operations against a sibling path that shares a prefix with the authorized path. The server accepts the operation because the prefix comparison succeeds, allowing cross-tenant file access without any credential theft, protocol abuse, or memory corruption.

// Patch: weed/sftpd/sftp_permissions.go
// Source: https://github.com/seaweedfs/seaweedfs/commit/29981f8d24a62e9571962c4534fb23c48c00bae2

// pathWithin reports whether candidate is base itself or a descendant of base,
// on path-component boundaries so /a does not match /a-sibling.
func pathWithin(base, candidate string) bool {
	base = stdpath.Clean(base)
	candidate = stdpath.Clean(candidate)
	if base == "/" {
		return strings.HasPrefix(candidate, "/")
	}
	return candidate == base || strings.HasPrefix(candidate, base+"/")
}

// isPathInHomeDirectory checks if a path is in the user's home directory
func isPathInHomeDirectory(user *user.User, path string) bool {
	if user.HomeDir == "" {
		return true
	}
	return pathWithin(user.HomeDir, path)
}

The fix normalizes both paths with stdpath.Clean and requires an exact match or a base+"/" prefix, restoring path-component boundary semantics. See the SeaweedFS security advisory GHSA-fvpg-g364-j8vh for full details.

Detection Methods for CVE-2026-77317

Indicators of Compromise

SFTP audit log entries where an authenticated user opens, reads, or writes files under a path that is not the user's configured home directory but shares a common prefix with it.
Unexpected SSH_FXP_OPEN, SSH_FXP_READ, or SSH_FXP_WRITE operations targeting tenant sibling directories such as /tenants/<name>-archive or /tenants/<name>2.
File modification timestamps on tenant data updated by an SFTP session belonging to a different tenant account.

Detection Strategies

Review SeaweedFS SFTP logs and correlate the authenticated username against the top-level directory of every accessed path. Alert when they do not match the configured home directory.
Enumerate configured ACL base paths and search access logs for operations on any path that shares a common prefix with, but is not a descendant of, an authorized path.
Add a static configuration audit that flags ACL base paths where sibling directories exist whose names begin with the same characters (for example alice and alice-archive).

Monitoring Recommendations

Forward SeaweedFS SFTP server logs to a centralized log platform and retain them for tenant-boundary investigations.
Baseline per-user SFTP access patterns and alert on first-seen path prefixes that fall outside the user's declared home directory.
Monitor for anomalous write activity from low-privilege accounts against directories owned by other tenants.

How to Mitigate CVE-2026-77317

Immediate Actions Required

Upgrade SeaweedFS to version 4.40 or later, which contains the pathWithin fix in weed/sftpd/sftp_permissions.go.
Inventory all SFTP user configurations and identify tenant directories whose names share a prefix with another tenant directory. Rename or isolate them before upgrading.
Rotate credentials for any SFTP account that could have leveraged the prefix ambiguity while the vulnerable version was deployed.

Patch Information

The fix is available in SeaweedFS 4.40. The upstream patch is committed in seaweedfs commit 29981f8d, which introduces the pathWithin helper and updates isPathInHomeDirectory to require path-component boundaries. Additional context is available in the GitHub Security Advisory GHSA-fvpg-g364-j8vh.

Workarounds

Restructure tenant directory naming so that no configured ACL base path is a string prefix of another tenant path. For example, use fixed-width identifiers or trailing separators in directory names.
Restrict SFTP access to trusted networks using firewall rules or a VPN until the upgrade to 4.40 is completed.
Temporarily revoke write permissions from SFTP users on shared parent directories to limit cross-tenant modification risk.

bash

# Verify installed SeaweedFS version and upgrade path
weed version

# Pull the fixed release container image
docker pull chrislusf/seaweedfs:4.40

# Restart the SFTP-enabled master and volume servers with the new image
docker compose up -d --force-recreate