SeaweedFS: github.com/seaweedfs/seaweedfs: SeaweedFS: Information disclosure via S3 API gateway path traversal (CVE-2026-55874)

Overview

A flaw was found in SeaweedFS, a distributed storage system. The S3 API gateway in SeaweedFS does not properly validate X-Amz-Copy-Source headers, specifically failing to reject "dot-dot" path segments. This allows an authenticated user, even if scoped to a single bucket, to read objects from other buckets through server-side copy operations. The vulnerability results in unauthorized information disclosure across storage buckets.

Vendor advisories

• RHSA-2026:68333 · Red Hat · fixed in: Cryostat 4 on RHEL 9 · released 2026-09-16 · advisory

SeaweedFS: github.com/seaweedfs/seaweedfs: SeaweedFS: Information disclosure via S3 API gateway path traversal — rated Important by Red Hat. Released 2026-07-08, updated 2026-09-16.

Fixed:

• Cryostat 4 on RHEL 9

Not affected:

• Cryostat 4 on RHEL 9

Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:68333

Workarounds / mitigations:

• Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

Package advisory (CVE-2026-55874)

Affected packages:

• github.com/seaweedfs/seaweedfs < 0.0.0-20260612000715-b44cf51fe931

Patched in:

• github.com/seaweedfs/seaweedfs 0.0.0-20260612000715-b44cf51fe931

Source: https://github.com/advisories/GHSA-56wq-x3wv-3ff4