Threats affecting pkg:golang/seaweedfs

SeaweedFS versions prior to 4.34 contain a path traversal vulnerability in the S3 gateway's DeleteMultipleObjectsHandler. Authenticated users with write access to a single bucket can exploit this flaw by including '../' sequences in object keys within the DeleteObjects XML request body. This allows deletion of objects outside their authorized bucket, bypassing authorization controls due to insufficient validation of request body keys. The vulnerability is fixed in version 4.34.