CVE-2026-55874
HighPrior to 4.34, the S3 API gateway does not reject dot-dot path segments in the X-Amz-Copy-Source header used by CopyObject and UploadPartCopy, allowing an authenticated identity scoped to one bucket to read objects from other buckets through server-side copy.
Published Jul 8, 2026 · Updated Sep 29, 2026 · Also known as BIT-seaweedfs-2026-55874, EUVD-2026-42285, GHSA-56wq-x3wv-3ff4, GO-2026-6327
Key Facts
Patch in the next maintenance window- CVE-2026-55874 is a high-severity vulnerability (CVSS 7.7 v3.1) affecting seaweedfs-cosi-driver (minimos), seaweedfs-cosi-driver-fips (minimos), seaweedfs (bitnami) and 1 more product.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 0.6% probability of exploitation in the next 30 days.
- Fixed versions are available, including github.com/seaweedfs/seaweedfs 0.0.0-20260612000715-b44cf51fe931, seaweedfs 4.34, seaweedfs 4.34.0.
- Brandefense priority: patch in the next maintenance window, because of its high severity, although no exploitation is known.
CVSS v3.1
7.7
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
EPSS (30-day exploit likelihood)
0.6%
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2026-55874 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
SeaweedFS is a distributed storage system. Prior to 4.34, the S3 API gateway does not reject dot-dot path segments in the X-Amz-Copy-Source header used by CopyObject and UploadPartCopy, allowing an authenticated identity scoped to one bucket to read objects from other buckets through server-side copy. This issue is fixed in version 4.34.
Affected Products
5 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| seaweedfs-cosi-driverminimos | See advisory | 0.3.1-r9 |
| seaweedfs-cosi-driver-fipsminimos | See advisory | 0.3.1-r9 |
| seaweedfsbitnami | >= < 4.34 | 4.34.0 |
| github.com/seaweedfs/seaweedfsgo | See advisory | 0.0.0-20260612000715-b44cf51fe931 |
Patched Releases
github.com/seaweedfs/seaweedfs
0.0.0-20260612000715-b44cf51fe931
seaweedfs
4.34, 4.34.0
seaweedfs-cosi-driver
0.3.1-r9
seaweedfs-cosi-driver-fips
0.3.1-r9
Timeline
Publicly disclosed
Jul 8, 2026
Last updated
Sep 29, 2026
Weakness Type
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
References
- advisoryGHSA advisory
- advisoryhttps://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55874.json
- articlehttps://nvd.nist.gov/vuln/detail/CVE-2026-55874
- otherhttps://github.com/seaweedfs/seaweedfs
- otherhttps://github.com/seaweedfs/seaweedfs/commit/b44cf51fe931bd75aa4d37ae766bea90d7f85ccd
FAQ
Common Questions.
SeaweedFS is a distributed storage system.
Affected: seaweedfs-cosi-driver (minimos); seaweedfs-cosi-driver-fips (minimos); seaweedfs (bitnami) versions >= < 4.34, among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including github.com/seaweedfs/seaweedfs 0.0.0-20260612000715-b44cf51fe931, seaweedfs 4.34, seaweedfs 4.34.0.
Brandefense priority: patch in the next maintenance window, because of its high severity, although no exploitation is known.
Is CVE-2026-55874 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo