CVE-2026-77763: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in juicedata juicefs

The filestore backend in juicefs (pkg/object/file.go) improperly limits pathname resolution when handling file operations such as Put, Get, Head, Delete, Chmod, Chown, Symlink, and Readlink. It constructs target paths by joining or cleaning the root directory with the object key but does not verify that the resulting path remains within the root directory. Object keys from source stores during sync can contain path traversal segments, enabling writes to arbitrary filesystem locations outside the intended root without error. This exposes operators syncing from untrusted buckets to potential unauthorized file writes. The patch changes the path resolution function to return an error and reject keys that escape the root directory.

An attacker able to control or influence object keys in a source bucket can cause juicefs to write files outside the designated directory on the local filesystem. This can lead to unauthorized file writes at attacker-chosen locations, potentially overwriting critical files or planting malicious content. The vulnerability does not impact confidentiality or availability directly but has a high impact on integrity. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor has implemented a fix that changes the path resolution logic to reject keys that resolve outside the root directory. Until the fix is applied, operators should avoid syncing from buckets that are shared, public, or writable by untrusted parties to mitigate risk.