Threat Intelligence Database

SeaweedFS versions before 4.30 contain a vulnerability where the callback query parameter is reflected without validation in JavaScript responses. This affects multiple JSON endpoints, including unauthenticated master and volume server endpoints, which can be accessed cross-origin via script tags. The absence of X-Content-Type-Options: nosniff headers and CORS allow-listing increases the risk of MIME-sniffing clients interpreting the response as HTML. This exposure allows third-party web pages to read sensitive cluster information such as topology, volume server URLs, gRPC ports, file identifiers, and directory listings.

SeaweedFS versions before 4.34 have a path traversal vulnerability in the S3 gateway's DeleteMultipleObjectsHandler. Authenticated S3 principals with write access to one bucket can delete objects in other tenants' buckets by using ../ sequences in the DeleteObjects XML request body. The vulnerability arises because the validateRequestPath middleware only checks URL path variables and not request-body keys, allowing directory traversal to bypass authorization controls.