AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

seaweedfsGHSA-q97m-8853-pq76

SeaweedFS Vulnerable to SQL Injection

seaweedfs

CVE-2024-40120 · Published May 16, 2025 · updated Sep 10, 2026

Medium6.5
Fix: upgrade to 0.0.0-20240625155419-9ac102336200 or later
GitHub advisory

seaweedfs v3.68 was discovered to contain a SQL injection vulnerability via the component /abstract_sql/abstract_sql_store.go.

Affected versions

PackageAffectedFixed in
github.com/seaweedfs/seaweedfs
Go
< 0.0.0-20240625155419-9ac1023362000.0.0-20240625155419-9ac102336200
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-89
Also known as
BIT-seaweedfs-2024-40120, CVE-2024-40120, GO-2025-3690

More seaweedfs advisories

All seaweedfs
High 8.1Sep 2SeaweedFS: Filer JWT allowed_prefixes literal prefix match allows cross-tenant access to sibling pathsCVE-2026-72921fixed in 0.0.0-20260512171048-05ed5c9ae8a2Critical 9.8Sep 2SeaweedFS: Unauthenticated filer IAM gRPC service grants S3 administrative controlCVE-2026-72920fixed in 0.0.0-20260512171108-5e8f99f40a8aHigh 7.7Aug 28SeaweedFS: Path traversal in the S3 gateway X-Amz-Copy-Source header allows cross-bucket object readCVE-2026-55874fixed in 0.0.0-20260612000715-b44cf51fe931Medium 4.3Aug 28seaweedfs: improper authorizationCVE-2026-55873fixed in 0.0.0-20260614205536-b13463880c1fHighAug 12SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket accessCVE-2026-54917fixed in 0.0.0-20260526080459-dd1b4287899eCritical 9.3Aug 11SeaweedFS: Unauthenticated SSRF with response read-back via VolumeServer.FetchAndWriteNeedleCVE-2026-73080fixed in 0.0.0-20260512171120-69da20bdaec9