Advisories · Technology
seaweedfs.
Every CVE that names seaweedfs among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.0 High
SeaweedFS: Hard-coded SSH host key can be presented by certain standalone SFTP Helm deployments
- seaweedfs
- Hard-coded credentials
- CVSS 7.1 High
SeaweedFS: Authenticated S3 object-scope bypass in PutObjectAcl allows overwriting a different object with the same basename
- seaweedfs
- Broken access control
- CVSS 8.1 High
SeaweedFS: SFTP path ACL literal prefix match permits cross-tenant file read and overwrite
- seaweedfs
- Broken access control
- CVSS 8.7 High
SeaweedFS S3 OIDC Bearer authentication bypasses IAM role trust policy
- seaweedfs
- Broken access control
- CVSS 7.6 High
SeaweedFS: Authenticated Cross-Prefix IDOR in Filer TUS Handler Enables Arbitrary Write to Tenant-Forbidden Paths
- seaweedfs
- Broken access control
- CVSS 2.3 Low
SeaweedFS < 4.30 - Cross-Origin Information Disclosure via Unvalidated JSONP callback Parameter
- seaweedfs
- Cross-site scripting (XSS)