SeaweedFS: Path traversal in the S3 gateway X-Amz-Copy-Source header allows cross-bucket object read (CVE-2026-55874)

The SeaweedFS S3 API gateway did not properly validate '..' path segments in the X-Amz-Copy-Source header used by CopyObject and UploadPartCopy. While the request URL path was hardened in version 4.30, the copy-source header was only checked for emptiness, allowing traversal segments to resolve into different buckets on the server-side filer path. This leads to a confused-deputy authorization bypass where IAM policies are evaluated against the destination bucket, but the copy source can be from any bucket, allowing an identity scoped to a single bucket to read objects from other buckets. The vulnerability affects all versions prior to 4.34. The fix in 4.34 applies validation to the copy-source header using the same checks as the request URL, rejecting traversal segments before processing.

This vulnerability allows an attacker with read/write permissions on a single bucket to bypass bucket isolation and read objects from any other bucket on the SeaweedFS instance. This results in unauthorized disclosure of data across buckets. The impact is limited to confidentiality (C), with no integrity or availability impact. The vulnerability requires the attacker to have some level of permission on a bucket but enables escalation of read access to other buckets.

Upgrade SeaweedFS to version 4.34 or later, where the vulnerability is fixed by validating the X-Amz-Copy-Source header to reject path traversal segments. For environments unable to upgrade immediately, deploy a reverse proxy in front of the gateway to block requests containing '..', '%2e%2e', or backslash sequences in the X-Amz-Copy-Source header. No other configuration workarounds are available.