CVE-2026-77317 in SeaweedFS
Summary
by MITRE • 08/27/2026
SeaweedFS is a distributed storage system for files and blobs. In versions from 3.88 through 4.39, the SFTP server evaluates configured path permissions with a literal string-prefix comparison, so a user scoped to a path is also granted the same access to any sibling path whose name merely begins with the same characters. A user granted access to /tenants/alice therefore also matches /tenants/alice-archive, /tenants/alice2, and similar siblings, because the check does not require a path-component boundary. An authenticated low-privilege SFTP user with a root home directory and narrow path permissions can thereby cross the configured ACL boundary to read another tenant's files, and to overwrite them if granted write, all through the documented SFTP service with its own valid credentials. This issue is fixed in version 4.40.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/27/2026
SeaweedFS serves as a distributed storage system designed for handling both files and blobs within enterprise environments. In versions ranging from 3.88 to 4.39, the implementation of its SFTP server contains a critical access control flaw related to path validation logic. The vulnerability stems from how the system evaluates configured path permissions during authentication and authorization phases. Specifically, the security mechanism relies on a literal string-prefix comparison rather than a structured path-component boundary check. This architectural oversight means that when determining if an authenticated user has permission to access a specific directory or file, the system simply checks if the requested path starts with the allowed prefix string without verifying that this match occurs at a distinct hierarchical level.
The technical flaw manifests as a classic authorization bypass where scope isolation is compromised due to insufficient delimiter validation. For instance, if a user account is explicitly scoped to access only the directory /tenants/alice, the system incorrectly grants them equivalent permissions for any sibling path whose name begins with those same characters. This includes paths such as /tenants/alice-archive or /tenants/alice2. Because the check does not require a path-component boundary, typically represented by a forward slash in Unix-like systems, the security filter fails to distinguish between the intended target and unrelated but similarly named resources. An attacker with valid credentials for this low-privilege user can therefore traverse beyond their designated scope simply by targeting these sibling paths.
The operational impact of this vulnerability is severe, particularly in multi-tenant environments where data isolation is paramount. An authenticated low-privilege SFTP user who possesses a root home directory and narrow path permissions can exploit this flaw to cross ACL boundaries. This allows the attacker to read sensitive files belonging to other tenants that should remain inaccessible. Furthermore, if the compromised account has write privileges within its original scope, it may also be able to overwrite or modify data in these sibling directories. The exploitation is straightforward as it utilizes the documented SFTP service with valid credentials, bypassing additional authentication layers and making detection through standard login monitoring difficult without deep packet inspection or specific audit logging enhancements.
This vulnerability aligns with CWE-284 Improper Access Control, specifically reflecting issues where access control decisions do not properly enforce scope boundaries. It also relates to CWE-732 Incorrect Permission Assignment for Critical Resource, as the system assigns permissions based on a flawed string matching logic rather than strict path hierarchy validation. From an ATT&CK perspective, this behavior facilitates lateral movement and data exfiltration within the storage infrastructure by allowing unauthorized access to restricted resources through valid credentials. The lack of proper boundary checks enables attackers to escalate their effective privileges relative to the data they can view or modify without needing to compromise additional accounts or exploit network-level vulnerabilities.
To mitigate this risk, organizations running SeaweedFS must upgrade immediately to version 4.40 or later, where the path permission evaluation logic has been corrected to enforce proper component boundaries. Until an upgrade is feasible, administrators should implement strict firewall rules and network segmentation to limit SFTP access to only necessary IP ranges. Additionally, enabling comprehensive audit logging for all file system operations can help detect anomalous access patterns indicative of this exploitation technique. It is also advisable to review user permissions and ensure that no single account has overly broad write privileges across multiple tenant directories, thereby reducing the potential blast radius if a credential is compromised. Regular security assessments focusing on path traversal and authorization logic should be integrated into the development lifecycle to prevent similar flaws in future updates.