{"id":"EUVD-2026-40360","enisaUuid":"9bef6249-be9f-3a4d-aada-61338ac90fb4","description":"SeaweedFS before 4.34 contains a path traversal vulnerability in the S3 gateway DeleteMultipleObjectsHandler that allows authenticated S3 principals with write access to a single bucket to delete arbitrary objects in other tenants\u0027 buckets by supplying object keys containing ../ sequences in the DeleteObjects XML request body. Attackers can bypass authorization controls through a confused deputy condition, as the validateRequestPath middleware only inspects URL-captured path variables and never examines request-body keys, allowing the filer path to collapse directory traversal sequences and resolve deletions outside the authorized bucket.","datePublished":"Jun 30, 2026, 3:57:59 PM","dateUpdated":"Oct 8, 2026, 3:23:29 PM","baseScore":7.2,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/seaweedfs/seaweedfs/releases/tag/4.34\nhttps://github.com/seaweedfs/seaweedfs/pull/9931\nhttps://github.com/seaweedfs/seaweedfs/commit/0345658ea8e7c6a3948ad190634b00866ec244c9\nhttps://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-w62w-66v9-vvgv\nhttps://github.com/geo-chen/oss/blob/main/seaweedfs.md\nhttps://www.vulncheck.com/advisories/seaweedfs-cross-bucket-object-deletion-via-deleteobjects-request-body-keys\n","aliases":"CVE-2026-58372\nGHSA-9cq9-w9qm-wc9p\n","assigner":"VulnCheck","epss":0.87,"enisaIdProduct":[{"id":"38542da5-35e8-33aa-8c68-d882ed7d0af9","product":{"name":"seaweedfs","vendor":{"name":"seaweedfs"}},"product_version":"0 \u003c4.34"}],"enisaIdVendor":[{"id":"6f7721dc-e7b2-3d74-a5d1-15edd28b828b","vendor":{"name":"seaweedfs"}}],"enisaIdVulnerability":[{"id":"3101a117-2dd6-332f-9b71-545848c3699e","vulnerability":{"id":"GHSA-9cq9-w9qm-wc9p","description":"SeaweedFS before 4.34 contains a path traversal vulnerability in the S3 gateway DeleteMultipleObjectsHandler that allows authenticated S3 principals with write access to a single bucket to delete arbitrary objects in other tenants\u0027 buckets by supplying object keys containing ../ sequences in the DeleteObjects XML request body. Attackers can bypass authorization controls through a confused deputy condition, as the validateRequestPath middleware only inspects URL-captured path variables and never examines request-body keys, allowing the filer path to collapse directory traversal sequences and resolve deletions outside the authorized bucket.","datePublished":"Jun 30, 2026, 6:31:40 PM","dateUpdated":"Jun 30, 2026, 6:31:40 PM","baseScore":0.0,"references":"https://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-w62w-66v9-vvgv\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-58372\nhttps://github.com/seaweedfs/seaweedfs/pull/9931\nhttps://github.com/seaweedfs/seaweedfs/commit/0345658ea8e7c6a3948ad190634b00866ec244c9\nhttps://github.com/geo-chen/oss/blob/main/seaweedfs.md\nhttps://github.com/seaweedfs/seaweedfs/releases/tag/4.34\nhttps://www.vulncheck.com/advisories/seaweedfs-cross-bucket-object-deletion-via-deleteobjects-request-body-keys\n","enisa_id":"EUVD-2026-40360\n","aliases":"GHSA-9cq9-w9qm-wc9p\nCVE-2026-58372\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"d2081cb1-98cd-349f-9d52-761b11b1554a","vulnerability":{"id":"CVE-2026-58372","description":"SeaweedFS before 4.34 contains a path traversal vulnerability in the S3 gateway DeleteMultipleObjectsHandler that allows authenticated S3 principals with write access to a single bucket to delete arbitrary objects in other tenants\u0027 buckets by supplying object keys containing ../ sequences in the DeleteObjects XML request body. Attackers can bypass authorization controls through a confused deputy condition, as the validateRequestPath middleware only inspects URL-captured path variables and never examines request-body keys, allowing the filer path to collapse directory traversal sequences and resolve deletions outside the authorized bucket.","datePublished":"Jun 30, 2026, 3:57:59 PM","dateUpdated":"Oct 8, 2026, 3:23:29 PM","status":"PUBLISHED","baseScore":7.2,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/seaweedfs/seaweedfs/releases/tag/4.34\nhttps://github.com/seaweedfs/seaweedfs/pull/9931\nhttps://github.com/seaweedfs/seaweedfs/commit/0345658ea8e7c6a3948ad190634b00866ec244c9\nhttps://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-w62w-66v9-vvgv\nhttps://github.com/geo-chen/oss/blob/main/seaweedfs.md\nhttps://www.vulncheck.com/advisories/seaweedfs-cross-bucket-object-deletion-via-deleteobjects-request-body-keys\n","enisa_id":"EUVD-2026-40360\n","assigner":"VulnCheck","epss":0.87,"dataProcessed":"Nov 1, 2026, 7:18:36 AM","vulnerabilityProduct":[{"id":"a3ead642-3d38-3faa-9214-3dae582b160e","product":{"name":"seaweedfs","vendor":{"name":"seaweedfs"}},"product_version":"0 \u003c4.34"}],"vulnerabilityVendor":[{"id":"195c2643-72db-3e23-8908-4e1cf29d2950","vendor":{"name":"seaweedfs"}}]}}],"enisaIdAdvisory":[{"id":"8f7c181d-0d28-364c-8061-53928b579496","advisory":{"id":"RHSA-2026:68333","description":"Red Hat Security Advisory: Red Hat build of Cryostat security update","summary":"An update is now available for the Red Hat build of Cryostat 4 on RHEL 9.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.","datePublished":"Sep 16, 2026, 5:16:26 PM","dateUpdated":"Oct 31, 2026, 11:04:56 PM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:68333\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68333.json\n","aliases":"CVE-2026-15075\nCVE-2026-15076\nCVE-2026-16308\nCVE-2026-33818\nCVE-2026-41178\nCVE-2026-45112\nCVE-2026-48586\nCVE-2026-49978\nCVE-2026-54399\nCVE-2026-54428\nCVE-2026-55831\nCVE-2026-55833\nCVE-2026-55851\nCVE-2026-55874\nCVE-2026-55969\nCVE-2026-56745\nCVE-2026-56746\nCVE-2026-56819\nCVE-2026-56854\nCVE-2026-56858\nCVE-2026-56859\nCVE-2026-56860\nCVE-2026-56862\nCVE-2026-58372\nCVE-2026-59869\nCVE-2026-59877\nCVE-2026-59899\nCVE-2026-68494\nCVE-2026-69152\nCVE-2026-69192\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"1bfae638-0fea-3f18-b1ca-af8220f323d1","product":{"name":"cryostat/cryostat-rhel9@sha256:4d1c6cfbce9d2a106ff1d14681fdc51d00b203f057d66e5023067b04d3429d20_arm64","vendor":{"name":"Red Hat"}}},{"id":"2dbd6354-3f45-378c-90a1-16edb92d814f","product":{"name":"cryostat/cryostat-reports-rhel9@sha256:09183b020f24f1b478b3391109f5b42aa066f9df71febec4c642621f82d3a304_amd64","vendor":{"name":"Red Hat"}}},{"id":"31970b28-8d79-39b0-93c1-9c824441ec73","product":{"name":"cryostat/cryostat-openshift-console-plugin-rhel9@sha256:11bda199b4124dd05b55b07b4d7508b1029371ad650afc3bba12b486011c6b26_amd64","vendor":{"name":"Red Hat"}}},{"id":"36da058c-f9f8-3d77-9eda-8b7a8589d649","product":{"name":"cryostat/cryostat-storage-rhel9@sha256:66f8afe0cebac9600554636ec0493a15634e6af6e94875b65bbdfb39ae92b4b3_arm64","vendor":{"name":"Red Hat"}}},{"id":"380f4d9c-73f3-3b2a-8fc4-5cdc1db03bea","product":{"name":"cryostat/cryostat-agent-init-rhel9@sha256:fd21840bc7fd04a3387186e8eadf3c1772b71c3a68d90c6f8f157de0c1e51826_amd64","vendor":{"name":"Red Hat"}}},{"id":"472b47d6-d85e-3415-aaa1-269db2fb4a25","product":{"name":"Cryostat 4 on RHEL 9","vendor":{"name":"Red Hat"}}},{"id":"474c5ae0-487d-3e33-9093-4ad5b64645e2","product":{"name":"cryostat/cryostat-grafana-dashboard-rhel9@sha256:8d67c1c76672ecb9241469355656c751bd8b54c138d6fb16866d604bb6da95ed_arm64","vendor":{"name":"Red Hat"}}},{"id":"49eb1e05-036b-3645-b9b8-639a26a0b503","product":{"name":"cryostat/cryostat-rhel9-operator@sha256:5091ea57743ec205834299edc38fc4bd011c7eb735bda422dc751a5084bb43af_amd64","vendor":{"name":"Red Hat"}}},{"id":"4c41cc27-4b05-3cc2-b200-569611be27e3","product":{"name":"cryostat/cryostat-storage-rhel9@sha256:5be66a00286e1733b91ea407788843a4123ff8bdcb830ec031bcd41b1e337255_amd64","vendor":{"name":"Red Hat"}}},{"id":"7a852870-7ebf-3b27-ac91-0a24560a4028","product":{"name":"cryostat/cryostat-db-rhel9@sha256:0bcd6d1e5fd1dc893c83641c96ebcdaf27fd576cd150d7c53a79ec99cd0581be_arm64","vendor":{"name":"Red Hat"}}},{"id":"7c0b9f87-b42a-3476-88f4-232c56bc5ec4","product":{"name":"cryostat/cryostat-openshift-console-plugin-rhel9@sha256:a1c2dfa85f82dd2bd96853270cd46de8dcffe4f6f81e7646eeb032843884ff94_arm64","vendor":{"name":"Red Hat"}}},{"id":"aab090bd-13f6-3f7f-9019-47d6f127016c","product":{"name":"cryostat/cryostat-rhel9-operator@sha256:a6932f33459645777f557163dd24c2d7dfd11bda6020d7dc144c65eda80a178e_arm64","vendor":{"name":"Red Hat"}}},{"id":"ac5d055a-5a3d-37f4-978e-11eae10c5a91","product":{"name":"cryostat/cryostat-reports-rhel9@sha256:56942fe083a729c20c316899678a9b8bcb53d7cd0166bf1d026e71e7d69aee86_arm64","vendor":{"name":"Red Hat"}}},{"id":"beca5587-130f-3a6a-8eed-32f7547ff37f","product":{"name":"cryostat/cryostat-rhel9@sha256:1bbd4a394a3ebcff86b518ec7a7d242088913052873b73cc2d7e09ed1b181c80_amd64","vendor":{"name":"Red Hat"}}},{"id":"c97d637f-c542-3271-8cd4-b71d9e420770","product":{"name":"cryostat/jfr-datasource-rhel9@sha256:23ea9da4ea97cdd04d95b500fbca8edd7db908fec16043ae1fa336634ffcd1fb_arm64","vendor":{"name":"Red Hat"}}},{"id":"cb1dda08-2efa-3311-b720-5c3511e2c72e","product":{"name":"cryostat/cryostat-agent-init-rhel9@sha256:bc47200b2bb00c9cb4f4ae4929d0faca3b7685ba160bafe07f773e8cfe977b6e_arm64","vendor":{"name":"Red Hat"}}},{"id":"dabd2c57-16d8-361c-a6e9-ce31d1012ee3","product":{"name":"cryostat/cryostat-grafana-dashboard-rhel9@sha256:a236a3646adf4c5b467e630cdd7b8ae4b5d874dc6342fcac1e5290c2beac0d06_amd64","vendor":{"name":"Red Hat"}}},{"id":"e14f9efb-4e71-3e58-a575-d1b93f0cd7c3","product":{"name":"cryostat/cryostat-db-rhel9@sha256:a1c62ba6ab13ab0b429552304050235f5d85870de0d5733bf4bf9240661e769d_amd64","vendor":{"name":"Red Hat"}}},{"id":"ecf9d6e6-2264-3d4e-9872-20481d47d3b2","product":{"name":"cryostat/cryostat-operator-bundle@sha256:01b7df9a63ddcffaca5f4594da01b1d0cb03fb4c0db8061266a67f027a67393b_arm64","vendor":{"name":"Red Hat"}}},{"id":"f1fa5ef5-fa5e-340d-a58d-245a24ee9266","product":{"name":"cryostat/jfr-datasource-rhel9@sha256:2663c6efa60f097f5b0be4a15f58bf1645b3313d1ebab6c19c42b8e6cc3e234a_amd64","vendor":{"name":"Red Hat"}}},{"id":"fdd0b91e-bbc1-3510-b581-52bbfeb5389f","product":{"name":"cryostat/cryostat-operator-bundle@sha256:1ff5e21e25d3c96ed212689f2b368b20a935f0669af31c37a1ae90cdf6be9d9e_amd64","vendor":{"name":"Red Hat"}}}]}}]}