The filestore backend in pkg/object/file.go of juicefs versions up to 1.4.1 improperly limits pathnames to a restricted directory. It derives operation targets from path(key) without verifying that the resolved path remains beneath the root directory. This allows object keys containing path traversal sequences to cause file writes outside the intended local destination during sync operations from external object stores. The vulnerability affects multiple file operations and can be exploited if syncing from buckets that are shared, public, or writable by attackers. The fix changes the path() function to return an error and reject keys whose resolved paths escape the root.

An attacker able to influence object keys in a synced bucket can cause juicefs to write files to arbitrary locations outside the intended directory on the local filesystem. This can lead to unauthorized file writes and potential integrity violations. There is no impact on confidentiality or availability reported. The vulnerability requires user interaction (UI:R) and no privileges (PR:N) to exploit remotely (AV:N).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The fix involves modifying the path resolution function to reject keys that escape the root directory. Until a patch is available, avoid syncing from buckets that are shared, public, or writable by untrusted parties to prevent exploitation.