THREATOPS
THREAT OPS › Threat News › [GHSA] GHSA-w62w-66v9-vvgv (high) — SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access

[GHSA] GHSA-w62w-66v9-vvgv (high) — SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access

medgithub_advisoriesPublished 2026-08-12

GHSA-w62w-66v9-vvgv Severity: high CVE: CVE-2026-54917

SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access

## Summary

The S3 API gateway and the Iceberg REST catalog gateway construct their routers with `mux.NewRouter().SkipClean(true)`. With path cleaning disabled, a `..` segment inside the URL survives routing, so a request such as:

``` GET /bucket-A/../e

Indicators of compromise

Original source: https://github.com/advisories/GHSA-w62w-66v9-vvgv