Critical vulnerabilities
10 critical vulnerabilities in SeaweedFS and Craft CMS
10 vulnerabilities rated critical (CVSS 9.0 or higher) found on 9 November 2026: SeaweedFS (9), SQL injection in servers and applications.
- 10 critical
SeaweedFS
9 vulnerabilities · Servers and applications
- 9.8Unauthenticated admin access to the S3 Tables, Iceberg and Lance APIs
- 9.8Unauthenticated S3 IAM-cache gRPC service allows credential injection and full S3 admin takeover
- 9.8Authorization bypass via the filer `?proxyChunkId=` branch dispatching ahead of the JWT gate, enabling unauthenticated chunk read and deletion
- 9.6iam:CreateServiceAccount accepts arbitrary ParentUser - one IAM grant mints credentials that authenticate as any user, including admin
- 9.3Unauthenticated SSRF via unguarded remote-storage callers in filer and S3 gateway
Show 4 more
- 9.1STS temporary credentials are recoverable from the session token
- 9.1Unauthenticated LifecycleDelete on SeaweedFS S3 internal gRPC port allows cross-bucket object/version deletion
- 9.1aws:SourceIp policy condition is spoofable via X-Forwarded-For/X-Real-Ip behind any private-looking peer
- 9.1Stored Seaweed-X-Amz-Version-Id header enables cross-tenant filer path traversal in the S3 gateway
SQL injection in servers and applications
1 vulnerability
From NVD, the CVE Program, OSV.dev with the GitHub Advisory Database, WPVulnerability, WordPress's security advisories and CISA's Known Exploited Vulnerabilities catalog, as they stood when this was written. Each vulnerability's own page has its latest rating and fix. This product uses the NVD API but is not endorsed or certified by the NVD.