CVE-2026-77611 in SeaweedFS
Summary
by MITRE • 08/27/2026
SeaweedFS is a distributed storage system for files and blobs. In versions prior to 4.40, an authenticated S3 principal with permissions scoped to a nested object key can overwrite a different object outside that scope by calling PutObjectAcl on the key it is allowed to access. The handler authorizes the request against the requested nested key but then writes the updated entry back to the bucket root rather than the key's actual parent directory, so an ACL change on allowed/protected.txt is instead applied to protected.txt at the bucket root. Because the update carries the full entry rather than only ACL metadata, an existing target object is overwritten with the content, metadata, owner information, and ACL of the scoped object, bypassing the object-level action scoping configured through the static S3 identity file. This issue is fixed in version 4.40.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/27/2026
SeaweedFS serves as a distributed storage system designed to handle files and blobs with high scalability and reliability. In versions prior to release 4.40, a critical security flaw exists within the S3-compatible API implementation that allows for unauthorized privilege escalation through improper access control enforcement. This vulnerability specifically affects authenticated principals who have been granted permissions scoped to specific nested object keys within the storage hierarchy. The core of the issue lies in how the system processes Access Control List modifications via the PutObjectAcl operation, revealing a significant disconnect between authorization checks and actual file system operations.
The technical flaw originates from an inconsistency in path resolution during ACL updates. When an authenticated user requests to modify the ACL for a specific nested object key they are permitted to access, the server correctly validates that the principal has permission for that target resource. However, upon authorizing the request, the handler incorrectly writes the updated entry back to the bucket root directory rather than persisting it in the actual parent directory of the requested key. This path resolution error means that an ACL change intended for a deeply nested file is instead applied to a top-level object with the same filename located at the root level. For instance, if a user has permission to modify allowed/protected.txt but attempts to update its ACL, the system erroneously overwrites protected.txt situated directly in the bucket root.
The operational impact of this vulnerability is severe due to the nature of how S3 ACL updates are implemented internally. Unlike standard metadata-only updates that might only alter permissions without touching content, the internal implementation carries the full entry data during these operations. Consequently, when the erroneous write occurs at the bucket root, it does not merely change permissions; it overwrites an existing target object with the complete content, metadata, owner information, and ACL of the scoped source object. This effectively bypasses the object-level action scoping configured through static S3 identity files, allowing a user to corrupt or replace data they should have no access to modify. The attacker can thus achieve unauthorized modification of critical root-level assets by exploiting this path traversal-like logic error in the API handler.
From a classification perspective, this vulnerability aligns with CWE-20 Improper Input Validation and CWE-732 Incorrect Permission Assignment for Critical Resource, as the system fails to correctly map user input (the requested key) to the correct underlying resource location before performing privileged operations. In terms of adversary tactics, this behavior is consistent with ATT&CK technique T1564.008 Host File System Discovery or more accurately T1222 Event Triggered Execution if used for persistence, but primarily it represents a privilege escalation vector similar to CWE-269 Improper Privilege Management where the user exploits a flaw in authorization logic to perform actions beyond their granted scope. The failure lies not in authentication but in the precise enforcement of resource boundaries during write operations.
To mitigate this risk, organizations running SeaweedFS must upgrade immediately to version 4.40 or later, which contains the patch for this path resolution error. Until upgrading is possible, administrators should review their S3 identity files and restrict permissions strictly to bucket root objects if nested object manipulation is not required, thereby reducing the attack surface. Additionally, implementing strict monitoring on PutObjectAcl calls can help detect anomalous patterns where ACL changes are frequently attempted on deeply nested paths that might trigger this bug in unpatched systems. Regular audits of file integrity at the bucket root level against expected states from deeper directories may also aid in early detection of exploitation attempts.