Advisoriesby Ibis
seaweedfs security advisories
7 advisories · 5 critical or high in 12 months · latest Sep 2
7 advisories
SeaweedFS: Filer JWT allowed_prefixes literal prefix match allows cross-tenant access to sibling pathsCVE-2026-72921fixed in 0.0.0-20260512171048-05ed5c9ae8a2SeaweedFS: Unauthenticated filer IAM gRPC service grants S3 administrative controlCVE-2026-72920fixed in 0.0.0-20260512171108-5e8f99f40a8aSeaweedFS: Path traversal in the S3 gateway X-Amz-Copy-Source header allows cross-bucket object readCVE-2026-55874fixed in 0.0.0-20260612000715-b44cf51fe931seaweedfs: improper authorizationCVE-2026-55873fixed in 0.0.0-20260614205536-b13463880c1fSeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket accessCVE-2026-54917fixed in 0.0.0-20260526080459-dd1b4287899eSeaweedFS: Unauthenticated SSRF with response read-back via VolumeServer.FetchAndWriteNeedleCVE-2026-73080fixed in 0.0.0-20260512171120-69da20bdaec9SeaweedFS Vulnerable to SQL InjectionCVE-2024-40120fixed in 0.0.0-20240625155419-9ac102336200About seaweedfs
SeaweedFS is a distributed storage system for object storage (S3), file systems, and Iceberg tables, designed to handle billions of files with O(1) disk access and effortless horizontal scaling.
Packages watched: github.com/seaweedfs/seaweedfs (Go).