SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-54917 · Microsoft / collected KEV context

CVE-2026-58372 · Microsoft / collected KEV context

EUVD-2026-39535

GHSA-w62w-66v9-vvgv

EUVD-2026-40360

GHSA-9cq9-w9qm-wc9p

BIT-seaweedfs-2026-54917

BIT-seaweedfs-2026-58372

GO-2026-6221

cve-program · CVE-2026-54917

• https://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-w62w-66v9-vvgv
• https://github.com/seaweedfs/seaweedfs/pull/9687

cve-program · CVE-2026-58372

• https://github.com/seaweedfs/seaweedfs/releases/tag/4.34
• https://github.com/seaweedfs/seaweedfs/pull/9931
• https://github.com/seaweedfs/seaweedfs/commit/0345658ea8e7c6a3948ad190634b00866ec244c9
• https://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-w62w-66v9-vvgv
• https://github.com/geo-chen/oss/blob/main/seaweedfs.md
• https://www.vulncheck.com/advisories/seaweedfs-cross-bucket-object-deletion-via-deleteobjects-request-body-keys

euvd · EUVD-2026-39535

• https://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-w62w-66v9-vvgv
• https://github.com/seaweedfs/seaweedfs/pull/9687

euvd · EUVD-2026-40360

• https://github.com/seaweedfs/seaweedfs/releases/tag/4.34
• https://github.com/seaweedfs/seaweedfs/pull/9931
• https://github.com/seaweedfs/seaweedfs/commit/0345658ea8e7c6a3948ad190634b00866ec244c9
• https://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-w62w-66v9-vvgv
• https://github.com/geo-chen/oss/blob/main/seaweedfs.md
• https://www.vulncheck.com/advisories/seaweedfs-cross-bucket-object-deletion-via-deleteobjects-request-body-keys

nvd · CVE-2026-54917

• https://github.com/seaweedfs/seaweedfs/pull/9687
• https://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-w62w-66v9-vvgv

nvd · CVE-2026-58372

• https://github.com/geo-chen/oss/blob/main/seaweedfs.md
• https://github.com/seaweedfs/seaweedfs/commit/0345658ea8e7c6a3948ad190634b00866ec244c9
• https://github.com/seaweedfs/seaweedfs/pull/9931
• https://github.com/seaweedfs/seaweedfs/releases/tag/4.34
• https://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-w62w-66v9-vvgv
• https://www.vulncheck.com/advisories/seaweedfs-cross-bucket-object-deletion-via-deleteobjects-request-body-keys

osv · GHSA-w62w-66v9-vvgv

• https://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-w62w-66v9-vvgv
• https://nvd.nist.gov/vuln/detail/CVE-2026-54917
• https://github.com/seaweedfs/seaweedfs/pull/9687
• https://github.com/seaweedfs/seaweedfs/commit/dd1b4287899eed3dfd73c2f3b1de001996fda229
• https://github.com/seaweedfs/seaweedfs

osv · GO-2026-6221

• https://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-w62w-66v9-vvgv
• https://nvd.nist.gov/vuln/detail/CVE-2026-54917
• https://github.com/seaweedfs/seaweedfs/commit/dd1b4287899eed3dfd73c2f3b1de001996fda229
• https://github.com/seaweedfs/seaweedfs/pull/9687

No related operational record is retained in the current change model.