SeaweedFS prior to version 4.30 reflects the callback query parameter verbatim in responses served with Content-Type application/javascript in the shared writeJson helper function. There is no validation of the callback name, no nosniff header, and no CORS allow-list, enabling cross-origin script tag inclusion of JSON endpoints. This affects unauthenticated master endpoints (/dir/status, /dir/lookup, /cluster/status), the volume server /status, and the filer directory listing, all accessible by default configurations. The vulnerability allows a third-party web page to read cluster topology and file system metadata. Additionally, the lack of nosniff headers may cause MIME-sniffing clients to interpret the reflected content as HTML, increasing potential attack surface.

An attacker can exploit this vulnerability to perform cross-origin data theft by injecting a script tag with a chosen callback parameter, allowing them to read sensitive cluster information such as topology, volume server URLs, gRPC ports, file identifiers, and directory listings. This exposure occurs without authentication and affects default configurations. However, the vulnerability requires user interaction (UI:P) and has high attack complexity (AC:H), limiting ease of exploitation. There is no indication of remote code execution or direct system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the meantime, users should consider restricting access to the affected JSON endpoints via network controls or configuration changes such as enabling whitelist restrictions or security.toml configurations. Implementing proper callback validation, adding X-Content-Type-Options: nosniff headers, and configuring CORS allow-lists would mitigate the vulnerability once patches or updates are available.