SeaweedFS Path Traversal Vulnerability: Early Warning

Severity

HIGH

Affected component

seaweedfs (github-actions)

Affected versions

>= 4.29, <= 4.29 or >= 4.28, <= 4.28 or >= 4.27, <= 4.27 or >= 4.26, <= 4.26 or >= 4.25, <= 4.25 or >= 4.24, <= 4.24 or >= 4.23, <= 4.23 or >= 4.22, <= 4.22 or >= 4.21, <= 4.21 or >= 4.20, <= 4.20 or >= 4.19, <= 4.19 or >= 4.18, <= 4.18 or >= 4.17, <= 4.17 or >= 4.16, <= 4.16 or >= 4.15, <= 4.15 or >= 4.13, <= 4.13 or >= 4.12, <= 4.12 or >= 4.09, <= 4.09 or >= 4.08, <= 4.08 or >= 4.07, <= 4.07 or >= 4.06, <= 4.06 or >= 4.05, <= 4.05 or >= 4.04, <= 4.04 or >= 4.03, <= 4.03 or >= 4.02, <= 4.02 or >= 4.01, <= 4.01 or >= 4.00, <= 4.00 or >= 3.99, <= 3.99 or >= 3.97, <= 3.97 or >= 3.96, <= 3.96 or >= 3.95, <= 3.95 or >= 3.94, <= 3.94 or >= 3.93, <= 3.93 or >= 3.92, <= 3.92 or >= 3.91, <= 3.91 or >= 3.90, <= 3.90 or >= 3.89, <= 3.89 or >= 3.88, <= 3.88 or >= 3.87, <= 3.87 or >= 3.86, <= 3.86 or >= 3.85, <= 3.85 or >= 3.84, <= 3.84 or >= 3.83, <= 3.83 or >= 3.82, <= 3.82 or >= 3.81, <= 3.81 or >= 3.80, <= 3.80 or >= 3.79, <= 3.79 or >= 3.78, <= 3.78 or >= 3.77, <= 3.77 or >= 3.76, <= 3.76 or >= 3.75, <= 3.75 or >= 3.74, <= 3.74 or >= 3.73, <= 3.73 or >= 3.72, <= 3.72 or >= 3.67, <= 3.67 or >= 3.66, <= 3.66 or >= 3.64, <= 3.64 or >= 3.63, <= 3.63 or >= 3.62, <= 3.62 or >= 3.61, <= 3.61 or >= 3.60, <= 3.60 or >= 3.59, <= 3.59 or >= 3.58, <= 3.58 or >= 3.57, <= 3.57 or >= 3.55, <= 3.55 or >= 3.54, <= 3.54 or >= 3.53, <= 3.53 or >= 3.52, <= 3.52 or >= 3.51, <= 3.51 or >= 3.50, <= 3.50 or >= 3.48, <= 3.48 or >= 3.47, <= 3.47 or >= 3.46, <= 3.46 or >= 3.45, <= 3.45 or >= 3.44, <= 3.44 or >= 3.43, <= 3.43 or >= 3.42, <= 3.42 or >= 3.41, <= 3.41 or >= 3.40, <= 3.40 or >= 3.39, <= 3.39 or >= 3.38, <= 3.38 or >= 3.37, <= 3.37 or >= 3.36, <= 3.36 or >= 3.35, <= 3.35 or >= 3.34, <= 3.34 or >= 3.33, <= 3.33 or >= v3.33, <= v3.33 or >= 3.32, <= 3.32 or >= 3.31, <= 3.31 or >= 3.30, <= 3.30 or >= 3.29, <= 3.29 or >= 3.28, <= 3.28 or >= 3.27, <= 3.27 or >= 3.26, <= 3.26 or >= 3.25, <= 3.25 or >= 3.24, <= 3.24 or >= 3.23, <= 3.23 or >= 3.22, <= 3.22 or >= 3.21, <= 3.21 or >= 3.20, <= 3.20 or >= 3.19, <= 3.19 or >= 3.18, <= 3.18 or >= 3.16, <= 3.16 or >= 3.15, <= 3.15 or >= dev, <= dev or >= 3.14, <= 3.14 or >= 3.13, <= 3.13 or >= 3.12, <= 3.12 or >= 3.11, <= 3.11 or >= 3.10, <= 3.10 or >= 3.09, <= 3.09 or >= 3.08, <= 3.08 or >= 3.07, <= 3.07 or >= 3.06, <= 3.06 or >= 3.05, <= 3.05 or >= 3.04, <= 3.04 or >= 3.03, <= 3.03 or >= 3.02, <= 3.02 or >= 3.01, <= 3.01 or >= 3.00, <= 3.00 or >= 2.99, <= 2.99 or >= 2.98, <= 2.98 or >= 2.97, <= 2.97 or >= 2.96, <= 2.96 or >= 2.95, <= 2.95 or >= 2.94, <= 2.94 or >= 2.93, <= 2.93 or >= 2.92, <= 2.92 or >= 2.91, <= 2.91 or >= 2.90, <= 2.90 or >= 2.89, <= 2.89 or >= 2.88, <= 2.88 or >= 2.87, <= 2.87 or >= 2.86, <= 2.86 or >= 2.85, <= 2.85 or >= 2.84, <= 2.84 or >= 2.83, <= 2.83 or >= 2.82, <= 2.82 or >= 2.80, <= 2.80 or >= 2.81, <= 2.81 or >= 2.79, <= 2.79 or >= 2.78, <= 2.78 or >= 2.77, <= 2.77 or >= 2.76, <= 2.76 or >= 2.75, <= 2.75 or >= 2.74, <= 2.74 or >= 2.73, <= 2.73 or >= 2.72, <= 2.72 or >= 2.71, <= 2.71 or >= 2.70, <= 2.70 or >= 2.69, <= 2.69 or >= 2.68, <= 2.68 or >= 2.67, <= 2.67 or >= 2.66, <= 2.66 or >= 2.65, <= 2.65 or >= 2.64, <= 2.64 or >= 2.63, <= 2.63 or >= 2.62, <= 2.62 or >= 2.61, <= 2.61 or >= 2.60, <= 2.60 or >= 2.59, <= 2.59 or >= 2.58, <= 2.58 or >= 2.57, <= 2.57 or >= 2.56, <= 2.56 or >= 2.55, <= 2.55 or >= 2.54, <= 2.54 or >= 2.53, <= 2.53 or >= 2.52, <= 2.52 or >= 2.51, <= 2.51 or >= 2.50, <= 2.50 or >= 2.49, <= 2.49 or >= 2.48, <= 2.48 or >= 2.47, <= 2.47 or >= 2.43, <= 2.43 or >= 2.42, <= 2.42 or >= 2.41, <= 2.41 or >= 2.40, <= 2.40 or >= 2.39, <= 2.39 or >= 2.38, <= 2.38 or >= 2.37, <= 2.37 or >= 2.36, <= 2.36 or >= 2.35, <= 2.35 or >= 2.34, <= 2.34 or >= 2.33, <= 2.33 or >= 2.32, <= 2.32 or >= 2.31, <= 2.31 or >= 2.30, <= 2.30 or >= 2.29, <= 2.29 or >= 2.28, <= 2.28 or >= 2.27, <= 2.27 or >= 2.26, <= 2.26 or >= 2.25, <= 2.25 or >= 2.24, <= 2.24 or >= 2.23, <= 2.23 or >= 2.22, <= 2.22 or >= 2.21, <= 2.21 or >= 2.19, <= 2.19 or >= 2.20, <= 2.20 or >= 2.18, <= 2.18 or >= 2.17, <= 2.17 or >= 2.16, <= 2.16 or >= 2.15, <= 2.15 or >= 2.14, <= 2.14 or >= 2.13, <= 2.13 or >= 2.12, <= 2.12 or >= 2.11, <= 2.11 or >= 2.10, <= 2.10 or >= 2.09, <= 2.09 or >= 2.08, <= 2.08 or >= 2.07, <= 2.07 or >= 2.06, <= 2.06 or >= 2.05, <= 2.05 or >= 2.04, <= 2.04 or >= 2.03, <= 2.03 or >= 2.02, <= 2.02 or >= 2.01, <= 2.01 or >= 2.00, <= 2.00 or >= 1.99, <= 1.99 or >= 1.98, <= 1.98 or >= 1.97, <= 1.97 or >= 1.96, <= 1.96 or >= 1.95, <= 1.95 or >= 1.94, <= 1.94 or >= 1.93, <= 1.93 or >= 1.92, <= 1.92 or >= 1.91, <= 1.91 or >= 1.90, <= 1.90 or >= 1.88, <= 1.88 or >= 1.87, <= 1.87 or >= 1.86, <= 1.86 or >= 1.85, <= 1.85 or >= 1.84, <= 1.84 or >= 1.83, <= 1.83 or >= 1.82, <= 1.82 or >= 1.81, <= 1.81 or >= 1.80, <= 1.80 or >= 1.79, <= 1.79 or >= 1.78, <= 1.78 or >= 1.77, <= 1.77 or >= 1.76, <= 1.76 or >= 1.75, <= 1.75 or >= 1.71, <= 1.71 or >= 1.74, <= 1.74 or >= 1.73, <= 1.73 or >= 1.72, <= 1.72 or >= 1;70, <= 1;70 or >= 1.70, <= 1.70 or >= 1.69, <= 1.69 or >= 1.68, <= 1.68 or >= 1.67, <= 1.67 or >= 1.66, <= 1.66 or >= 1.65, <= 1.65 or >= 1.64, <= 1.64 or >= 1.63, <= 1.63 or >= 1.62, <= 1.62 or >= 1.61, <= 1.61 or >= 1.61RC, <= 1.61RC or >= 1.45, <= 1.45 or >= 1.60, <= 1.60 or >= 1.59, <= 1.59 or >= 1.58, <= 1.58 or >= 1.57, <= 1.57 or >= 1.56, <= 1.56 or >= 1.55, <= 1.55 or >= 1.54, <= 1.54 or >= 1.53, <= 1.53 or >= 1.52, <= 1.52 or >= 1.51, <= 1.51 or >= 1.50, <= 1.50 or >= 1.49, <= 1.49 or >= 1.48, <= 1.48 or >= 1.47, <= 1.47 or >= 1.46, <= 1.46 or >= 1.44, <= 1.44 or >= 1.43, <= 1.43 or >= 1.42, <= 1.42 or >= 1.41, <= 1.41 or >= 1.40, <= 1.40 or >= 1.38, <= 1.38 or >= 1.37, <= 1.37 or >= 1.36, <= 1.36 or >= 1.35, <= 1.35 or >= 1.33, <= 1.33 or >= 1.32, <= 1.32 or >= 1.31, <= 1.31 or >= 1.30, <= 1.30 or >= 1.29, <= 1.29 or >= 1.28, <= 1.28 or >= 1.27, <= 1.27 or >= 1.26, <= 1.26 or >= 1.25, <= 1.25 or >= 1.24, <= 1.24 or >= 1.23, <= 1.23 or >= 1.22, <= 1.22 or >= 1.21, <= 1.21 or >= 1.20, <= 1.20 or >= 1.19, <= 1.19 or >= 1.18, <= 1.18 or >= 1.17, <= 1.17 or >= 1.16, <= 1.16 or >= 1.15, <= 1.15 or >= 1.14, <= 1.14 or >= 1.12, <= 1.12 or >= 1.11, <= 1.11 or >= 1.10, <= 1.10 or >= 1.09, <= 1.09 or >= 1.08, <= 1.08 or >= 1.07, <= 1.07 or >= 1.06, <= 1.06 or >= 1.05, <= 1.05 or >= 1.04, <= 1.04 or >= 1.03, <= 1.03 or >= 1.02, <= 1.02 or >= 1.01, <= 1.01 or >= 1.00, <= 1.00 or >= 0.99, <= 0.99 or >= 0.98, <= 0.98 or >= 0.97, <= 0.97 or >= 0.96, <= 0.96 or >= 0.95, <= 0.95 or >= 0.94, <= 0.94 or >= 0.93, <= 0.93 or >= 0.92, <= 0.92 or >= 0.91, <= 0.91 or >= 0.90, <= 0.90 or >= 0.77, <= 0.77 or >= 0.76, <= 0.76 or >= 0.75, <= 0.75 or >= 0.74, <= 0.74 or >= 0.73, <= 0.73 or >= 0.72.release, <= 0.72.release or >= 0.72, <= 0.72 or >= v0.70beta, <= v0.70beta or >= v0.69, <= v0.69

Patched version

4.34

An early warning has been issued for a path traversal vulnerability in the SeaweedFS S3 API gateway. This vulnerability could allow cross-bucket object read.

What happened

The SeaweedFS S3 API gateway reportedly did not reject `..` path segments in the `X-Amz-Copy-Source` header. This could lead to a confused-deputy authorization bypass that breaks bucket isolation. The vulnerability is under investigation and has not been exploited in the wild. To assess your exposure, check if you are using an affected version of SeaweedFS.

Affected versions include all versions from 0.72.release to 4.29. If you are using any of these versions, you are potentially vulnerable. It is recommended to upgrade to version 4.34 or later to mitigate the vulnerability.

What to do about it

• Check your SeaweedFS version to determine if you are using an affected version.
• If you are using an affected version, upgrade to SeaweedFS version 4.34 or later.
• Monitor the primary sources for updates on the vulnerability and any additional mitigation steps.

How 0Day would have caught this

Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.

Frequently asked questions

Sources

• [GHSA-56wq-x3wv-3ff4] SeaweedFS: Path traversal in the S3 gateway X-Amz-Copy-Source header allows cross-bucket object read

Join the 0Day waitlist →

← Back to all threats