CVE-2026-55874

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-55874", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-17T16:59:42.759Z", "datePublished": "2026-07-08T14:43:40.155Z", "dateUpdated": "2026-07-08T17:01:02.948Z"}, "containers": {"cna": {"title": "SeaweedFS: Path traversal in the S3 gateway X-Amz-Copy-Source header allows cross-bucket object read", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-56wq-x3wv-3ff4", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-56wq-x3wv-3ff4"}, {"name": "https://github.com/seaweedfs/seaweedfs/pull/9929", "tags": ["x_refsource_MISC"], "url": "https://github.com/seaweedfs/seaweedfs/pull/9929"}, {"name": "https://github.com/seaweedfs/seaweedfs/commit/b44cf51fe931bd75aa4d37ae766bea90d7f85ccd", "tags": ["x_refsource_MISC"], "url": "https://github.com/seaweedfs/seaweedfs/commit/b44cf51fe931bd75aa4d37ae766bea90d7f85ccd"}, {"name": "https://github.com/seaweedfs/seaweedfs/releases/tag/4.34", "tags": ["x_refsource_MISC"], "url": "https://github.com/seaweedfs/seaweedfs/releases/tag/4.34"}], "affected": [{"vendor": "seaweedfs", "product": "seaweedfs", "versions": [{"version": "< 4.34", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-08T14:43:40.155Z"}, "descriptions": [{"lang": "en", "value": "SeaweedFS is a distributed storage system. Prior to 4.34, the S3 API gateway does not reject dot-dot path segments in the X-Amz-Copy-Source header used by CopyObject and UploadPartCopy, allowing an authenticated identity scoped to one bucket to read objects from other buckets through server-side copy. This issue is fixed in version 4.34."}], "source": {"advisory": "GHSA-56wq-x3wv-3ff4", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-08T16:52:14.324777Z", "id": "CVE-2026-55874", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-08T17:01:02.948Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-55874", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-08T16:52:14.324777Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-08T16:52:22.834Z"}}], "cna": {"title": "SeaweedFS: Path traversal in the S3 gateway X-Amz-Copy-Source header allows cross-bucket object read", "source": {"advisory": "GHSA-56wq-x3wv-3ff4", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "seaweedfs", "product": "seaweedfs", "versions": [{"status": "affected", "version": "< 4.34"}]}], "references": [{"url": "https://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-56wq-x3wv-3ff4", "name": "https://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-56wq-x3wv-3ff4", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/seaweedfs/seaweedfs/pull/9929", "name": "https://github.com/seaweedfs/seaweedfs/pull/9929", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/seaweedfs/seaweedfs/commit/b44cf51fe931bd75aa4d37ae766bea90d7f85ccd", "name": "https://github.com/seaweedfs/seaweedfs/commit/b44cf51fe931bd75aa4d37ae766bea90d7f85ccd", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/seaweedfs/seaweedfs/releases/tag/4.34", "name": "https://github.com/seaweedfs/seaweedfs/releases/tag/4.34", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "SeaweedFS is a distributed storage system. Prior to 4.34, the S3 API gateway does not reject dot-dot path segments in the X-Amz-Copy-Source header used by CopyObject and UploadPartCopy, allowing an authenticated identity scoped to one bucket to read objects from other buckets through server-side copy. This issue is fixed in version 4.34."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-08T14:43:40.155Z"}}}, "cveMetadata": {"cveId": "CVE-2026-55874", "state": "PUBLISHED", "dateUpdated": "2026-07-08T17:01:02.948Z", "dateReserved": "2026-06-17T16:59:42.759Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-08T14:43:40.155Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "seaweedfs", "vendor": "seaweedfs", "versions": [{"status": "affected", "version": "< 4.34"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "SeaweedFS is a distributed storage system. Prior to 4.34, the S3 API gateway does not reject dot-dot path segments in the X-Amz-Copy-Source header used by CopyObject and UploadPartCopy, allowing an authenticated identity scoped to one bucket to read objects from other buckets through server-side copy. This issue is fixed in version 4.34."}], "id": "CVE-2026-55874", "lastModified": "2026-07-08T18:16:33.270", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 4.0, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-55874", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-08T16:52:14.324777Z", "version": "2.0.3"}}]}, "published": "2026-07-08T15:16:30.320", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/seaweedfs/seaweedfs/commit/b44cf51fe931bd75aa4d37ae766bea90d7f85ccd"}, {"source": "security-advisories@github.com", "url": "https://github.com/seaweedfs/seaweedfs/pull/9929"}, {"source": "security-advisories@github.com", "url": "https://github.com/seaweedfs/seaweedfs/releases/tag/4.34"}, {"source": "security-advisories@github.com", "url": "https://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-56wq-x3wv-3ff4"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "SeaweedFS: github.com/seaweedfs/seaweedfs: SeaweedFS: Information disclosure via S3 API gateway path traversal", "id": "2498092", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498092"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.7", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-22", "details": ["SeaweedFS is a distributed storage system. Prior to 4.34, the S3 API gateway does not reject dot-dot path segments in the X-Amz-Copy-Source header used by CopyObject and UploadPartCopy, allowing an authenticated identity scoped to one bucket to read objects from other buckets through server-side copy. This issue is fixed in version 4.34.", "A flaw was found in SeaweedFS, a distributed storage system. The S3 API gateway in SeaweedFS does not properly validate `X-Amz-Copy-Source` headers, specifically failing to reject \"dot-dot\" path segments. This allows an authenticated user, even if scoped to a single bucket, to read objects from other buckets through server-side copy operations. The vulnerability results in unauthorized information disclosure across storage buckets."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-55874", "package_state": [{"cpe": "cpe:/a:redhat:cryostat:4", "fix_state": "Affected", "package_name": "cryostat/cryostat-storage-rhel9", "product_name": "Cryostat 4"}], "public_date": "2026-07-08T14:43:40Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-55874\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-55874\nhttps://github.com/seaweedfs/seaweedfs/commit/b44cf51fe931bd75aa4d37ae766bea90d7f85ccd\nhttps://github.com/seaweedfs/seaweedfs/pull/9929\nhttps://github.com/seaweedfs/seaweedfs/releases/tag/4.34\nhttps://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-56wq-x3wv-3ff4"], "statement": "Important: This flaw in SeaweedFS allows an authenticated attacker to bypass intended access controls within the S3 API gateway. By crafting a malicious `X-Amz-Copy-Source` header with \"dot-dot\" path segments, an attacker with limited bucket access can read objects from other unauthorized buckets. This could lead to unauthorized information disclosure in Red Hat Cryostat deployments utilizing SeaweedFS for storage.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,4.34)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "seaweedfs", "source": "cna", "vendor": "seaweedfs"}, "product": "seaweedfs", "vendor": "seaweedfs"}], "created": "2026-07-08T16:45:03.647815+00:00", "updated": "2026-08-01T16:15:07.343936+00:00", "vendors": ["seaweedfs", "seaweedfs$PRODUCT$seaweedfs"]}