The vulnerability in SeaweedFS prior to version 4.34 involves the S3 gateway's DeleteMultipleObjectsHandler, which improperly validates object keys in the DeleteObjects XML request body. Authenticated users with write permissions on a single bucket can exploit this by supplying object keys containing directory traversal sequences (../), enabling deletion of arbitrary objects in other tenants' buckets. This occurs due to a confused deputy condition where the middleware only inspects URL path variables but not the request body, allowing the path to collapse traversal sequences and bypass bucket-level authorization.

An attacker with authenticated write access to one bucket can delete objects in other tenants' buckets, potentially causing data loss or disruption across multiple tenants sharing the SeaweedFS service. This bypasses intended authorization controls and compromises data isolation between tenants.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict write access to trusted principals only and monitor for suspicious deletion requests containing directory traversal sequences. Avoid exposing the vulnerable S3 gateway to untrusted users.