CVE-2026-58372— SeaweedFS < 4.34 - Cross-Bucket Object Deletion via DeleteObjects Request-Body Keys
Possible ATT&CK Techniques 2AI
T1068 · Exploitation for Privilege Escalation T1530 · Data from Cloud StorageGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-58372
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
SeaweedFS < 4.34 - Cross-Bucket Object Deletion via DeleteObjects Request-Body Keys
Source: CVE Program / CVE List V5
Vulnerability Description
SeaweedFS before 4.34 contains a path traversal vulnerability in the S3 gateway DeleteMultipleObjectsHandler that allows authenticated S3 principals with write access to a single bucket to delete arbitrary objects in other tenants' buckets by supplying object keys containing ../ sequences in the DeleteObjects XML request body. Attackers can bypass authorization controls through a confused deputy condition, as the validateRequestPath middleware only inspects URL-captured path variables and never examines request-body keys, allowing the filer path to collapse directory traversal sequences and resolve deletions outside the authorized bucket.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Vulnerability Title
SeaweedFS 路径遍历漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
SeaweedFS是SeaweedFS团队开源的一个用于blob、对象、文件和数据湖的快速分布式存储系统。 SeaweedFS 4.34之前版本存在路径遍历漏洞，该漏洞源于S3 gateway DeleteMultipleObjectsHandler中存在路径遍历问题，允许经过身份验证的S3主体通过提供包含../序列的对象密钥在DeleteObjects XML请求体中，删除其他租户存储桶中的任意对象，攻击者还可能通过混乱副手条件绕过授权控制。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-58372
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
Qwen3.6-35B-A3B · 9419 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month
III. Intelligence Information for CVE-2026-58372
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-58372 (1)
Vendor Advisories for CVE-2026-58372 (2)
Vendor Pages for CVE-2026-58372 (1)
- 🔗 Release 4.34 · seaweedfs/seaweedfs · GitHubrelease-notes
Other References for CVE-2026-58372 (1)
IV. Related Vulnerabilities
Same product: seaweedfs
Same vendor: seaweedfs
Same weakness: CWE-22
- CVE-2026-56673
ComfyUI: Path traversal in LoadImage via the /prompt API all - CVE-2026-56671
ComfyUI: Path traversal in /experiment/models/preview allows - CVE-2026-63222
CodeIgniter: Path traversal in UploadedFile::move() when usi - CVE-2026-55495
Cloudreve: Path Traversal in WOPI PUT_RELATIVE Allows Arbitr - CVE-2026-66755
Apache Tika: Arbitrary Local File Read in ISArchiveParser
V. Comments for CVE-2026-58372
No comments yet