CVE-2026-58371— SeaweedFS < 4.30 - Cross-Origin Information Disclosure via Unvalidated JSONP callback Parameter

SeaweedFS < 4.30 - Cross-Origin Information Disclosure via Unvalidated JSONP callback Parameter

SeaweedFS before 4.30 reflects the callback query parameter verbatim into responses served with Content-Type application/javascript in the shared writeJson helper (weed/server/common.go), with no callback-name validation, no X-Content-Type-Options: nosniff header, and no CORS allow-list. Every JSON endpoint that uses writeJson - including the unauthenticated master endpoints /dir/status, /dir/lookup and /cluster/status, the volume server /status, and the filer directory listing, all reachable in the default configuration (no -whiteList, no security.toml, bound to 0.0.0.0) - can therefore be loaded cross-origin via a script tag with a chosen callback, letting a third-party web page read cluster topology, volume server URLs and gRPC ports, file identifiers, and directory listings. Because the callback string is reflected at the start of the body and no nosniff header is sent, MIME-sniffing clients may also interpret the reflected content as HTML.

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

SeaweedFS 跨站脚本漏洞

SeaweedFS是SeaweedFS团队开源的一个用于blob、对象、文件和数据湖的快速分布式存储系统。 SeaweedFS 4.30之前版本存在跨站脚本漏洞，该漏洞源于在共享writeJson helper中对回调查询参数未进行验证、未设置X-Content-Type-Options: nosniff标头且无CORS白名单，可能被第三方网页通过脚本标签跨域加载，读取集群拓扑、卷服务器URL和gRPC端口、文件标识符及目录列表。

N/A

N/A