CVE-2026-77763: JuiceFS Path Traversal Vulnerability

CVE-2026-77763 Overview

CVE-2026-77763 is a path traversal vulnerability [CWE-22] in JuiceFS, an open-source distributed POSIX file system. The flaw resides in the filestore backend implemented in pkg/object/file.go, which is used for file:// stores and as a common juicefs sync destination. The path() helper joined caller-supplied object keys onto the storage root without verifying that the resolved path remained beneath it. As a result, an object key containing traversal segments causes JuiceFS to write attacker-supplied content to a path outside the intended local destination during a sync from an untrusted source bucket.

Critical Impact
An operator syncing from a shared, public, or attacker-writable bucket can be coerced into writing arbitrary files outside the configured destination directory, with no error returned to signal the escape.

Affected Products

JuiceFS distributed POSIX file system
JuiceFS filestore backend (pkg/object/file.go) used for file:// object stores
JuiceFS sync command when the destination is a local filestore backend

Discovery Timeline

2026-08-21 - CVE-2026-77763 published to the National Vulnerability Database (NVD)
2026-08-21 - Last updated in NVD database

Technical Details for CVE-2026-77763

Vulnerability Analysis

The filestore backend derived every filesystem operation's target from a helper named path(key). That helper returned either filepath.Join(d.root, key) or filepath.Clean(d.root + key) and performed no containment check against d.root. The Put, Get, Head, Delete, Chmod, Chown, Symlink, and Readlink methods all consumed the returned path directly.

Object keys enumerated from a source object store are not subject to the same character restrictions as local filesystem names. A key such as ../../etc/attacker therefore resolves outside d.root after joining and cleaning. Because no error is returned when the resolved path escapes the root, the sync appears successful while writing attacker-controlled content to attacker-influenced locations.

Exploitation requires an operator to run juicefs sync against a source bucket whose contents they do not fully control. Public buckets, shared buckets, and buckets an attacker can write to all satisfy this condition. The user interaction requirement is limited to the operator initiating the sync.

Root Cause

The root cause is missing input validation on untrusted object keys before path construction. The path() function trusted callers to supply safe keys and did not verify that the cleaned result was a descendant of the configured root directory.

Attack Vector

An attacker plants objects with keys containing ../ traversal segments in a source object store. When an operator runs juicefs sync from that store to a local filestore destination, JuiceFS reads each key, computes a target path via path(), and writes the object contents to that path. The write succeeds outside the destination root, enabling file overwrite at attacker-influenced locations subject to the JuiceFS process's filesystem permissions.

// Patched Symlink method in pkg/object/file.go
func (d *filestore) Symlink(oldName, newName string) error {
-	p := d.path(newName)
+	p, err := d.path(newName)
+	if err != nil {
+		return err
+	}
	if _, err := os.Stat(filepath.Dir(p)); err != nil && os.IsNotExist(err) {
		if err := os.MkdirAll(filepath.Dir(p), os.FileMode(0777)); err != nil {
			return err

Source: JuiceFS commit 0bcd70b3

// Patched Chtimes method in pkg/object/file_unix.go
func (d *filestore) Chtimes(key string, mtime time.Time) error {
-	p := d.path(key)
+	p, err := d.path(key)
+	if err != nil {
+		return err
+	}
	return lchtimes(p, time.Time{}, mtime)
}

Source: JuiceFS commit 0bcd70b3

The fix changes path() to return an error and rejects any key whose resolved path escapes the root, and every filestore method is updated to propagate that error.

Detection Methods for CVE-2026-77763

Indicators of Compromise

Files created outside the configured JuiceFS destination root after a juicefs sync run, particularly under sensitive directories such as /etc, /root, or a user's ~/.ssh.
Source bucket listings containing object keys with ../ sequences, absolute paths, or embedded null or slash characters.
Successful sync completion logs with no error while file counts at the destination root do not match expected source contents.

Detection Strategies

Audit source object stores prior to sync operations and reject or quarantine any object whose key contains .., leading /, or other traversal patterns.
Compare juicefs sync file inventories against the destination directory tree to identify writes that landed outside d.root.
Instrument the JuiceFS binary version in use across hosts and flag any deployment running a filestore backend that predates the fix in pull request 7425.

Monitoring Recommendations

Enable filesystem auditing (for example, Linux auditd watches) on directories adjacent to and above JuiceFS destination roots to catch out-of-bounds writes.
Alert on process creations of juicefs sync where the source URL points to a bucket that is not on an approved allowlist.
Forward JuiceFS operational logs to a centralized logging platform and correlate sync events with unexpected file creations on the host.

How to Mitigate CVE-2026-77763

Immediate Actions Required

Upgrade JuiceFS to the release that contains the fix from pull request 7425 and commit 0bcd70b3.
Pause juicefs sync operations that use a local filestore destination and pull from buckets that are shared, public, or writable by third parties until the upgrade is complete.
Review destination hosts for files written outside the intended root during recent syncs and restore or remove any unauthorized artifacts.

Patch Information

The upstream fix is tracked in JuiceFS issue 7401 and merged via pull request 7425. The patched path() function now returns an error whenever the resolved target escapes the configured root, and every consumer in pkg/object/file.go and pkg/object/file_unix.go propagates that error rather than performing the requested operation. See the VulnCheck advisory for additional context.

Workarounds

Only run juicefs sync against source buckets whose object keys are fully trusted and generated by controlled writers.
Run the juicefs process under a dedicated, minimally privileged user account so that any out-of-bounds write is confined by filesystem permissions.
Pre-scan source bucket listings and remove or rename any object whose key contains .., leading slashes, or other traversal characters before initiating a sync.

bash

# Pre-sync validation: list source keys and reject traversal patterns
aws s3 ls --recursive s3://source-bucket/ \
  | awk '{print $4}' \
  | grep -E '(^/|\.\./|/\.\./)' \
  && echo 'Unsafe keys detected - aborting sync' && exit 1

# Upgrade JuiceFS to a patched release before resuming sync
juicefs version
go install github.com/juicedata/juicefs@latest