Upstream information

CVE-2026-54917 at MITRE

Description

SeaweedFS is a distributed storage system for object storage (S3), file systems, and Iceberg tables. Prior to 4.30, the S3 API gateway and the Iceberg REST catalog gateway construct their routers with mux.NewRouter().SkipClean(true). With path cleaning disabled, a .. segment inside the URL survives routing, so a request such as `GET /bucket-A/../evil-bucket/key`, is matched as bucket=bucket-A, object=../evil-bucket/key. The captured object key is then joined into a filer path with util.JoinPath (S3) / path.Join (Iceberg), which collapse the .. server-side, so the actual read or write lands in evil-bucket. This vulnerability is fixed in 4.30.

SUSE information

Overall state of this security issue: Resolved

This issue is currently rated as having critical severity.

CVSS v3 Scores
CVSS detail National Vulnerability Database
Base Score 10
Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Changed
Confidentiality Impact High
Integrity Impact High
Availability Impact None
CVSSv3 Version 3.1
CVSS v4 Scores
CVSS detail CNA (GitHub)
Base Score 7.8
Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Attack Requirements None
Privileges Required None
User Interaction None
Vulnerable System Confidentiality Impact None
Vulnerable System Integrity Impact None
Vulnerable System Availability Impact None
Subsequent System Confidentiality Impact High
Subsequent System Integrity Impact High
Subsequent System Availability Impact None
CVSSv4 Version 4.0
No SUSE Bugzilla entries cross referenced.

SUSE Security Advisories:

List of released packages

Product(s) Fixed package version(s) References
SUSE Linux Enterprise Server 16.1
  • govulncheck-vulndb >= 0.0.20260916T180043-160100.1.1
 Patchnames:
SUSE Linux Enterprise Server 16.1 GA govulncheck-vulndb-0.0.20260916T180043-160100.1.1 (aarch64,ppc64le,s390x,x86_64)
SUSE Linux Enterprise Server for SAP applications 16.1
  • govulncheck-vulndb >= 0.0.20260916T180043-160100.1.1
 Patchnames:
SUSE Linux Enterprise Server for SAP applications 16.1 GA govulncheck-vulndb-0.0.20260916T180043-160100.1.1 (aarch64,ppc64le,s390x,x86_64)

SUSE Timeline for this CVE

CVE page created: Fri Sep 4 16:49:01 2026
CVE page last modified: Wed Oct 28 14:06:59 2026