Threats affecting pkg:github/seaweedfs

CVE-2026-58371 is a cross-site scripting (XSS) vulnerability in SeaweedFS versions before 4.30. It arises from improper neutralization of the callback query parameter in JSON endpoints, which are served with Content-Type application/javascript without validation or security headers. This allows a third-party web page to load these endpoints cross-origin via a script tag and read sensitive cluster information such as topology, volume server URLs, gRPC ports, file identifiers, and directory listings. The vulnerability affects multiple unauthenticated endpoints accessible by default configurations. The issue is fixed in SeaweedFS version 4.30.