CVE-2026-77317 seaweedfs CVE debrief

Who should care

Defenders responsible for SeaweedFS deployments, particularly those with multi-tenant environments, should assess exposure and prioritize patching to version 4.40 or later. They should review SFTP user permissions and path configurations to prevent exploitation. Defenders should verify affected versions and remediation status. This issue may impact operators, platforms, vulnerability-management teams, and security teams

Why it matters

CVE-2026-77317 is a high-severity vulnerability in SeaweedFS that allows authenticated low-privilege SFTP users to access and overwrite files belonging to other tenants. Defenders should prioritize patching to version 4.40 or later and review SFTP user permissions and path configurations to prevent exploitation.

• Authenticated low-privilege SFTP users can access files belonging to other tenants
• Authenticated low-privilege SFTP users can overwrite files belonging to other tenants if granted write access
• Requires verification of affected versions and remediation status
• Defenders should review SFTP user permissions and path configurations to prevent exploitation

Technical summary

The SFTP server in SeaweedFS evaluates configured path permissions with a literal string-prefix comparison, allowing users to access sibling paths with similar names. An authenticated low-privilege SFTP user with a root home directory and narrow path permissions can cross the configured ACL boundary to read another tenant's files, and to overwrite them if granted write access. This issue has been fixed in version 4.40. The vulnerability is caused by a flawed path permission evaluation in the SFTP server, which allows users to access sibling paths with similar names

Defensive priority

Defenders should prioritize patching to version 4.40 or later, and review SFTP user permissions and path configurations.

Recommended defensive actions

• Patch SeaweedFS to version 4.40 or later
• Review SFTP user permissions and path configurations
• Monitor SFTP activity for suspicious behavior
• Verify affected versions and remediation status
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. The vulnerability is caused by a flawed path permission evaluation in the SFTP server, which allows users to access sibling paths with similar names. This issue has been fixed in version 4.40. Defenders should verify affected versions and remediation status. The SFTP server evaluates configured path permissions with a literal string-prefix comparison, allowing users to access sibling paths with similar names

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.