high · 7.7CVE-2026-55874Aug 28, 2026

CVE-2026-55874: SeaweedFS S3 Gateway Cross-Bucket Path Traversal via X-Amz-Copy-Source

Pranav Khune
Penetration Testing Team Lead, SecureLayer7

A flaw in SeaweedFS lets an attacker who controls one bucket read objects from any other bucket on the same instance by smuggling dot-dot segments in the S3 copy-source header, bypassing bucket-level…

Packagegithub.com/seaweedfs/seaweedfs
Ecosystemgo
Affected< 0.0.0-20260612000715-b44cf51fe931
Fixed in0.0.0-20260612000715-b44cf51fe931
CVE-2026-55874: SeaweedFS S3 Gateway Cross-Bucket Path Traversal via X-Amz-Copy-Source

The problem

The SeaweedFS S3 gateway parses the X-Amz-Copy-Source request header for CopyObject and UploadPartCopy but only checked it for emptiness. It never rejected .. path segments.

Because IAM evaluates the caller's policy against the destination bucket in the request URL, an identity legitimately scoped to one bucket can supply a traversal sequence in the copy-source header and force the server to read from any other bucket. The attacker then retrieves the result from the destination bucket it controls.

Proof of concept

A working proof-of-concept for CVE-2026-55874 in github.com/seaweedfs/seaweedfs, with the exact payload below.

http
PUT /bucket-a/stolen-object HTTP/1.1
Host: seaweedfs-s3-gateway:8333
Authorization: AWS4-HMAC-SHA256 Credential=ATTACKER_KEY/...
X-Amz-Copy-Source: /bucket-a/../victim-bucket/sensitive-object
Content-Length: 0

The gateway passed the raw X-Amz-Copy-Source value straight into filer path resolution without sanitizing .. segments. Path traversal in the header caused the filer to resolve bucket-a/../victim-bucket/sensitive-object as /buckets/victim-bucket/sensitive-object, escaping the authorized bucket entirely.

The prior fix for CVE-2026-54917 hardened the request URL path with IsValidBucketName and IsValidObjectKey guards applied in a routing middleware, but those guards were never wired to the copy-source header. PR #9929 closes the gap by running the same validators against the parsed copy-source bucket name and object key before any handler logic executes.

Inputs containing .., empty segments, or other traversal tokens are now rejected with an HTTP 400 before the filer is consulted.

CWE-22: Improper Limitation of a Pathname to a Restricted Directory.

The fix

Upgrade to SeaweedFS 4.34 (commit b44cf51fe931bd75aa4d37ae766bea90d7f85ccd). If an immediate upgrade is not possible, front the gateway with a reverse proxy that rejects any request whose X-Amz-Copy-Source header contains .., %2e%2e, or backslash sequences.

There is no configuration-only workaround in older versions.

Reported by @47Cid.

References: [1][2][3][4][5][6]

Related research