CVE-2026-77317: 
Wolfi vulnerability analysis and mitigation

CVE-2026-77317 is an incorrect authorization vulnerability in the SeaweedFS SFTP server that allows authenticated low-privilege users to bypass configured ACL boundaries and access sibling tenant directories. The flaw affects SeaweedFS versions 3.88 through 4.39 (inclusive), introduced when the SFTP implementation was added in release 3.88. It was disclosed on August 26, 2026, with a fix available in version 4.40. The vulnerability carries a CVSS v3.1 base score of 8.1 (High) (GitHub Advisory, Feedly).

The root cause is an incorrect authorization check (CWE-863) in weed/sftpd/sftp_permissions.go, where path permission evaluation uses strings.HasPrefix(filepath, p) — a raw string-prefix comparison that does not enforce path-component boundaries. As a result, a permission entry for /tenants/alice inadvertently matches sibling paths such as /tenants/alice-archive, /tenants/alice2, and /tenants/alice-backup, because the check does not require a trailing / separator or exact equality. The same flaw exists in the isPathInHomeDirectory function. Exploitation requires only valid SFTP credentials for a low-privilege account with a root home directory (HomeDir: "/") and narrow path permissions; no elevated privileges or special configuration are needed beyond access to the SFTP port (GitHub Advisory, Fix Commit).

An authenticated low-privilege SFTP user can cross configured ACL boundaries to read files belonging to other tenants (confidentiality impact) and, if granted write permissions on their own path, overwrite files in sibling tenant directories (integrity impact). This enables cross-tenant data disclosure and data tampering in multi-tenant SeaweedFS deployments, entirely through the documented SFTP service using the attacker's own valid credentials. Availability is not directly impacted, but overwriting critical tenant files could cause indirect service disruption (GitHub Advisory).

No public proof-of-concept exploit code has been published, and there is no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. However, the attack is straightforward for any authenticated SFTP user in a multi-tenant deployment — no special tooling is required beyond a standard SFTP client and knowledge of sibling path naming conventions (GitHub Advisory).

1. Reconnaissance: Identify a SeaweedFS deployment (versions 3.88–4.39) with SFTP enabled and multi-tenant path-based ACLs configured. Determine the naming convention of tenant directories (e.g., /tenants/<name>).
2. Obtain credentials: Acquire valid SFTP credentials for a low-privilege account scoped to a specific path (e.g., /tenants/alice) with HomeDir: "/".
3. Connect via SFTP: Use any standard SFTP client (e.g., sftp, WinSCP, FileZilla) to authenticate to the SeaweedFS SFTP port with the low-privilege credentials.
4. Enumerate sibling paths: Attempt to list or access sibling directories whose names share the same string prefix as the permitted path (e.g., /tenants/alice-archive, /tenants/alice2, /tenants/alice-backup).
5. Read sibling tenant files: Open and download files from the sibling directory (e.g., get /tenants/alice-archive/secret.txt) — the flawed prefix check grants read access.
6. Overwrite sibling tenant files: If the attacker's account has write permission on their own path, upload or modify files in the sibling directory (e.g., put malicious.txt /tenants/alice-archive/secret.txt) to tamper with another tenant's data (GitHub Advisory).

• Network: SFTP connections (typically TCP port 22 or a custom SFTP port) from a low-privilege user account accessing paths outside their configured ACL scope; repeated SFTP session activity targeting multiple tenant directories from a single user.
• Logs: SeaweedFS SFTP access logs showing a scoped user (e.g., scoped) successfully reading or writing files under sibling paths (e.g., /tenants/alice-archive/) that are not listed in that user's configured permissions; unexpected file open/create operations on tenant directories not matching the user's ACL entry.
• File System: Unexpected modifications or new files in tenant directories that should only be writable by their respective tenant accounts; file timestamps inconsistent with normal tenant activity.
• Process/Behavior: Unusual SFTP session patterns where a single low-privilege user accesses multiple tenant namespaces in rapid succession (GitHub Advisory).

Upgrade SeaweedFS to version 4.40 or later, which replaces the flawed strings.HasPrefix path comparison with a pathWithin helper that enforces path-component boundaries (requiring exact equality or a separator-delimited descendant) (Fix Commit). If immediate patching is not possible, restrict SFTP access at the network level to trusted users only, and avoid deploying multi-tenant configurations with sibling path naming conventions until the patch is applied. Additionally, audit SFTP access logs for any cross-tenant file access that may have occurred on affected versions (GitHub Advisory).

The advisory was prepared with AI assistance and manually validated end-to-end against SeaweedFS 4.39 by the reporter (DavidCarliez), and published by SeaweedFS maintainer chrislusf on August 21, 2026 (GitHub Advisory). Brief mention of the vulnerability appeared on Mastodon via @thehackerwire shortly after disclosure. No broader media coverage or significant community debate has been observed at this time.