{"metadata": {"vulnerability": "CVE-2026-55874", "count": 81, "kinds": {"milestone": 6, "sighting": 1, "kev": 0, "other": 74}}, "data": [{"timestamp": "2026-06-04T14:38:23.707Z", "date_only": false, "value": "2026-06-04T14:38:23.707000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:68333", "record": "RHSA-2026:68333", "field": "vulnerabilities.4.release_date"}, {"timestamp": "2026-06-04T16:01:10.300Z", "date_only": false, "value": "2026-06-04T16:01:10.300537+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:68333", "record": "RHSA-2026:68333", "field": "vulnerabilities.4.discovery_date"}, {"timestamp": "2026-06-17T16:59:42.759Z", "date_only": false, "value": "2026-06-17T16:59:42.759Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-55874", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-06-30T15:57:59.372Z", "date_only": false, "value": "2026-06-30T15:57:59.372000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:68333", "record": "RHSA-2026:68333", "field": "vulnerabilities.23.release_date"}, {"timestamp": "2026-06-30T17:01:35.444Z", "date_only": false, "value": "2026-06-30T17:01:35.444287+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:68333", "record": "RHSA-2026:68333", "field": "vulnerabilities.23.discovery_date"}, {"timestamp": "2026-07-01T17:02:21.778Z", "date_only": false, "value": "2026-07-01T17:02:21.778000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:68333", "record": "RHSA-2026:68333", "field": "vulnerabilities.8.release_date"}, {"timestamp": "2026-07-01T17:03:53.938Z", "date_only": false, "value": "2026-07-01T17:03:53.938000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:68333", "record": "RHSA-2026:68333", "field": "vulnerabilities.9.release_date"}, {"timestamp": "2026-07-01T18:02:08.214Z", "date_only": false, "value": "2026-07-01T18:02:08.214968+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:68333", "record": "RHSA-2026:68333", "field": "vulnerabilities.8.discovery_date"}, {"timestamp": "2026-07-01T18:02:25.195Z", "date_only": false, "value": "2026-07-01T18:02:25.195687+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:68333", "record": "RHSA-2026:68333", "field": "vulnerabilities.9.discovery_date"}, {"timestamp": "2026-07-08T14:43:40.155Z", "date_only": false, "value": "2026-07-08T14:43:40.155Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-55874", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-07-08T14:43:40.155Z", "date_only": false, "value": "2026-07-08T14:43:40.155000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:68333", "record": "RHSA-2026:68333", "field": "vulnerabilities.13.release_date"}, {"timestamp": "2026-07-08T14:43:40.155Z", "date_only": false, "value": "2026-07-08T14:43:40.155Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-55874", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-07-08T15:02:44.110Z", "date_only": false, "value": "2026-07-08T15:02:44.110862+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:68333", "record": "RHSA-2026:68333", "field": "vulnerabilities.13.discovery_date"}, {"timestamp": "2026-07-08T15:15:54.675Z", "date_only": false, "value": "2026-07-08T15:15:54.675000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:68333", "record": "RHSA-2026:68333", "field": "vulnerabilities.24.release_date"}, {"timestamp": "2026-07-08T15:16:30Z", "date_only": false, "value": "2026-07-08T15:16:30Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-56WQ-X3WV-3FF4", "record": "GHSA-56WQ-X3WV-3FF4", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-07-08T15:16:30.320Z", "date_only": false, "value": "2026-07-08T15:16:30.320", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-55874", "record": "FKIE_CVE-2026-55874", "field": "published"}, {"timestamp": "2026-07-08T15:28:07.696Z", "date_only": false, "value": "2026-07-08T15:28:07.696000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:68333", "record": "RHSA-2026:68333", "field": "vulnerabilities.25.release_date"}, {"timestamp": "2026-07-08T16:01:38.408Z", "date_only": false, "value": "2026-07-08T16:01:38.408322+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:68333", "record": "RHSA-2026:68333", "field": "vulnerabilities.24.discovery_date"}, {"timestamp": "2026-07-08T16:01:54.459Z", "date_only": false, "value": "2026-07-08T16:01:54.459482+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:68333", "record": "RHSA-2026:68333", "field": "vulnerabilities.25.discovery_date"}, {"timestamp": "2026-07-08T16:52:14.324Z", "date_only": false, "value": "2026-07-08T16:52:14.324777Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-55874", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-07-08T16:52:14.324Z", "date_only": false, "value": "2026-07-08T16:52:14.324777Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-55874", "record": "FKIE_CVE-2026-55874", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-07-08T17:01:02.948Z", "date_only": false, "value": "2026-07-08T17:01:02.948Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-55874", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-07-08T17:01:02.948Z", "date_only": false, "value": "2026-07-08T17:01:02.948Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-55874", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-07-08T18:16:33.270Z", "date_only": false, "value": "2026-07-08T18:16:33.270", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-55874", "record": "FKIE_CVE-2026-55874", "field": "lastModified"}, {"timestamp": "2026-07-09T00:00:00Z", "date_only": false, "value": "2026-07-09T00:00:00+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:68333", "record": "RHSA-2026:68333", "field": "vulnerabilities.26.discovery_date"}, {"timestamp": "2026-07-09T00:00:00Z", "date_only": false, "value": "2026-07-09T00:00:00+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:68333", "record": "RHSA-2026:68333", "field": "vulnerabilities.26.release_date"}, {"timestamp": "2026-07-14T08:09:12.951Z", "date_only": false, "value": "2026-07-14T08:09:12.951000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:68333", "record": "RHSA-2026:68333", "field": "vulnerabilities.1.release_date"}, {"timestamp": "2026-07-14T08:15:53.650Z", "date_only": false, "value": "2026-07-14T08:15:53.650000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:68333", "record": "RHSA-2026:68333", "field": "vulnerabilities.0.release_date"}, {"timestamp": "2026-07-14T08:55:20.997Z", "date_only": false, "value": "2026-07-14T08:55:20.997Z", "kind": "milestone", "label": "Published", "source": "bitnami_vulndb \u00b7 BIT-SEAWEEDFS-2026-55874", "record": "BIT-SEAWEEDFS-2026-55874", "field": "published"}, {"timestamp": "2026-07-14T09:00:58.070Z", "date_only": false, "value": "2026-07-14T09:00:58.070373+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:68333", "record": "RHSA-2026:68333", "field": "vulnerabilities.1.discovery_date"}, {"timestamp": "2026-07-14T09:01:12.413Z", "date_only": false, "value": "2026-07-14T09:01:12.413297+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:68333", "record": "RHSA-2026:68333", "field": "vulnerabilities.0.discovery_date"}, {"timestamp": "2026-07-14T09:10:57.073Z", "date_only": false, "value": "2026-07-14T09:10:57.073Z", "kind": "other", "label": "Updated", "source": "bitnami_vulndb \u00b7 BIT-SEAWEEDFS-2026-55874", "record": "BIT-SEAWEEDFS-2026-55874", "field": "modified"}, {"timestamp": "2026-07-14T20:02:46.263Z", "date_only": false, "value": "2026-07-14T20:02:46.263000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:68333", "record": "RHSA-2026:68333", "field": "vulnerabilities.7.release_date"}, {"timestamp": "2026-07-14T21:05:26.253Z", "date_only": false, "value": "2026-07-14T21:05:26.253019+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:68333", "record": "RHSA-2026:68333", "field": "vulnerabilities.7.discovery_date"}, {"timestamp": "2026-07-20T23:00:31.859Z", "date_only": false, "value": "2026-07-20T23:00:31.859000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:68333", "record": "RHSA-2026:68333", "field": "vulnerabilities.10.release_date"}, {"timestamp": "2026-07-20T23:18:07.893Z", "date_only": false, "value": "2026-07-20T23:18:07.893000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:68333", "record": "RHSA-2026:68333", "field": "vulnerabilities.11.release_date"}, {"timestamp": "2026-07-21T00:01:25.203Z", "date_only": false, "value": "2026-07-21T00:01:25.203265+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:68333", "record": "RHSA-2026:68333", "field": "vulnerabilities.11.discovery_date"}, {"timestamp": "2026-07-21T00:02:57.305Z", "date_only": false, "value": "2026-07-21T00:02:57.305291+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:68333", "record": "RHSA-2026:68333", "field": "vulnerabilities.10.discovery_date"}, {"timestamp": "2026-07-21T21:22:34.879Z", "date_only": false, "value": "2026-07-21T21:22:34.879000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:68333", "record": "RHSA-2026:68333", "field": "vulnerabilities.12.release_date"}, {"timestamp": "2026-07-21T21:31:25.307Z", "date_only": false, "value": "2026-07-21T21:31:25.307000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:68333", "record": "RHSA-2026:68333", "field": "vulnerabilities.15.release_date"}, {"timestamp": "2026-07-21T21:36:18.627Z", "date_only": false, "value": "2026-07-21T21:36:18.627000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:68333", "record": "RHSA-2026:68333", "field": "vulnerabilities.16.release_date"}, {"timestamp": "2026-07-21T22:11:17.470Z", "date_only": false, "value": "2026-07-21T22:11:17.470000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:68333", "record": "RHSA-2026:68333", "field": "vulnerabilities.17.release_date"}, {"timestamp": "2026-07-21T22:30:30.983Z", "date_only": false, "value": "2026-07-21T22:30:30.983812+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:68333", "record": "RHSA-2026:68333", "field": "vulnerabilities.16.discovery_date"}, {"timestamp": "2026-07-21T22:43:00.311Z", "date_only": false, "value": "2026-07-21T22:43:00.311516+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:68333", "record": "RHSA-2026:68333", "field": "vulnerabilities.12.discovery_date"}, {"timestamp": "2026-07-21T22:52:47.296Z", "date_only": false, "value": "2026-07-21T22:52:47.296001+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:68333", "record": "RHSA-2026:68333", "field": "vulnerabilities.15.discovery_date"}, {"timestamp": "2026-07-21T23:03:36.448Z", "date_only": false, "value": "2026-07-21T23:03:36.448652+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:68333", "record": "RHSA-2026:68333", "field": "vulnerabilities.17.discovery_date"}, {"timestamp": "2026-07-23T09:57:24.306Z", "date_only": false, "value": "2026-07-23T09:57:24.306000+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:68333", "record": "RHSA-2026:68333", "field": "vulnerabilities.2.discovery_date"}, {"timestamp": "2026-07-27T10:57:34.326Z", "date_only": false, "value": "2026-07-27T10:57:34.326000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:68333", "record": "RHSA-2026:68333", "field": "vulnerabilities.5.release_date"}, {"timestamp": "2026-07-27T11:02:54.430Z", "date_only": false, "value": "2026-07-27T11:02:54.430000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:68333", "record": "RHSA-2026:68333", "field": "vulnerabilities.6.release_date"}, {"timestamp": "2026-07-27T11:07:53.785Z", "date_only": false, "value": "2026-07-27T11:07:53.785000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:68333", "record": "RHSA-2026:68333", "field": "vulnerabilities.14.release_date"}, {"timestamp": "2026-07-27T12:01:08.265Z", "date_only": false, "value": "2026-07-27T12:01:08.265881+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:68333", "record": "RHSA-2026:68333", "field": "vulnerabilities.14.discovery_date"}, {"timestamp": "2026-07-27T12:01:11.736Z", "date_only": false, "value": "2026-07-27T12:01:11.736259+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:68333", "record": "RHSA-2026:68333", "field": "vulnerabilities.6.discovery_date"}, {"timestamp": "2026-07-27T12:01:28.483Z", "date_only": false, "value": "2026-07-27T12:01:28.483023+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:68333", "record": "RHSA-2026:68333", "field": "vulnerabilities.5.discovery_date"}, {"timestamp": "2026-07-29T13:19:42.315Z", "date_only": false, "value": "2026-07-29T13:19:42.315000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:68333", "record": "RHSA-2026:68333", "field": "vulnerabilities.2.release_date"}, {"timestamp": "2026-08-03T16:33:36.324Z", "date_only": false, "value": "2026-08-03T16:33:36.324000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:68333", "record": "RHSA-2026:68333", "field": "vulnerabilities.28.release_date"}, {"timestamp": "2026-08-03T18:01:13.566Z", "date_only": false, "value": "2026-08-03T18:01:13.566423+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:68333", "record": "RHSA-2026:68333", "field": "vulnerabilities.28.discovery_date"}, {"timestamp": "2026-08-03T19:56:13.640Z", "date_only": false, "value": "2026-08-03T19:56:13.640000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:68333", "record": "RHSA-2026:68333", "field": "vulnerabilities.29.release_date"}, {"timestamp": "2026-08-03T21:02:17.374Z", "date_only": false, "value": "2026-08-03T21:02:17.374935+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:68333", "record": "RHSA-2026:68333", "field": "vulnerabilities.29.discovery_date"}, {"timestamp": "2026-08-04T14:39:14.471Z", "date_only": false, "value": "2026-08-04T14:39:14.471000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:68333", "record": "RHSA-2026:68333", "field": "vulnerabilities.27.release_date"}, {"timestamp": "2026-08-04T15:01:53.631Z", "date_only": false, "value": "2026-08-04T15:01:53.631865+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:68333", "record": "RHSA-2026:68333", "field": "vulnerabilities.27.discovery_date"}, {"timestamp": "2026-08-13T21:58:52.821Z", "date_only": false, "value": "2026-08-13T21:58:52.821000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:68333", "record": "RHSA-2026:68333", "field": "vulnerabilities.3.release_date"}, {"timestamp": "2026-08-13T21:58:52.959Z", "date_only": false, "value": "2026-08-13T21:58:52.959000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:68333", "record": "RHSA-2026:68333", "field": "vulnerabilities.20.release_date"}, {"timestamp": "2026-08-13T21:58:53.216Z", "date_only": false, "value": "2026-08-13T21:58:53.216000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:68333", "record": "RHSA-2026:68333", "field": "vulnerabilities.22.release_date"}, {"timestamp": "2026-08-13T21:58:53.354Z", "date_only": false, "value": "2026-08-13T21:58:53.354000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:68333", "record": "RHSA-2026:68333", "field": "vulnerabilities.19.release_date"}, {"timestamp": "2026-08-13T21:58:53.731Z", "date_only": false, "value": "2026-08-13T21:58:53.731000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:68333", "record": "RHSA-2026:68333", "field": "vulnerabilities.21.release_date"}, {"timestamp": "2026-08-13T22:12:37.151Z", "date_only": false, "value": "2026-08-13T22:12:37.151735+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:68333", "record": "RHSA-2026:68333", "field": "vulnerabilities.3.discovery_date"}, {"timestamp": "2026-08-13T22:13:18.319Z", "date_only": false, "value": "2026-08-13T22:13:18.319384+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:68333", "record": "RHSA-2026:68333", "field": "vulnerabilities.21.discovery_date"}, {"timestamp": "2026-08-13T22:16:32.034Z", "date_only": false, "value": "2026-08-13T22:16:32.034590+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:68333", "record": "RHSA-2026:68333", "field": "vulnerabilities.19.discovery_date"}, {"timestamp": "2026-08-13T22:16:41.928Z", "date_only": false, "value": "2026-08-13T22:16:41.928450+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:68333", "record": "RHSA-2026:68333", "field": "vulnerabilities.22.discovery_date"}, {"timestamp": "2026-08-13T22:16:52.493Z", "date_only": false, "value": "2026-08-13T22:16:52.493058+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:68333", "record": "RHSA-2026:68333", "field": "vulnerabilities.20.discovery_date"}, {"timestamp": "2026-08-28T15:14:26.918Z", "date_only": false, "value": "2026-08-28T15:14:26.918000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:68333", "record": "RHSA-2026:68333", "field": "vulnerabilities.18.release_date"}, {"timestamp": "2026-08-28T15:33:34.404Z", "date_only": false, "value": "2026-08-28T15:33:34.404578+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:68333", "record": "RHSA-2026:68333", "field": "vulnerabilities.18.discovery_date"}, {"timestamp": "2026-08-28T22:17:33Z", "date_only": false, "value": "2026-08-28T22:17:33Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-56WQ-X3WV-3FF4", "record": "GHSA-56WQ-X3WV-3FF4", "field": "published"}, {"timestamp": "2026-08-28T22:17:33Z", "date_only": false, "value": "2026-08-28T22:17:33Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-56WQ-X3WV-3FF4", "record": "GHSA-56WQ-X3WV-3FF4", "field": "modified"}, {"timestamp": "2026-08-29T11:31:50.433Z", "date_only": false, "value": "2026-08-29T11:31:50.433163Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/f39d221628c93e95f65b186b807e9a92", "record": "CVE-2026-55874", "field": "creation_timestamp", "uuid": "68cbd222-e74b-461f-bb69-f403a048bd90", "content": "# CVE-2026-55874: CVE-2026-55874: Cross-Bucket Path Traversal in SeaweedFS S3 API Gateway\n\n> **CVSS Score:** 7.7\n> **Published:** 2026-08-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-55874\n\n## Summary\nA critical path traversal vulnerability (CVE-2026-55874) in the SeaweedFS S3 API Gateway prior to version 4.34 allows authenticated remote attackers with write access to at least one bucket to bypass isolation. By supplying crafted directory traversal sequences in the X-Amz-Copy-Source header, an attacker can read objects from arbitrary buckets on the same deployment.\n\n## TL;DR\nSeaweedFS S3 API Gateway allows cross-bucket reads via path traversal in the X-Amz-Copy-Source header prior to version 4.34.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-22\n- **Attack Vector**: Network\n- **CVSS Score**: 7.7\n- **EPSS Score**: 0.00606\n- **Exploit Status**: poc\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- SeaweedFS\n- **SeaweedFS**: < 4.34 (Fixed in: `4.34`)\n\n## Mitigation\n\n- Upgrade SeaweedFS to version 4.34 or later to address the vulnerability in the codebase.\n- Deploy Web Application Firewall (WAF) rules targeting the X-Amz-Copy-Source header to filter and block path traversal sequences.\n- Audit historic S3 access logs and reverse proxy logs for requests involving parent directory segments in copy handlers.\n\n**Remediation Steps:**\n1. Identify all deployed SeaweedFS S3 API Gateway instances.\n2. Schedule maintenance windows to deploy SeaweedFS version 4.34 or higher.\n3. If immediate upgrade is impossible, write a custom WAF signature or Nginx rule to check the X-Amz-Copy-Source header for path-traversal strings.\n4. Verify blocking efficacy with standard S3 testing utilities.\n\n## References\n\n- [SeaweedFS Fix Commit](https://github.com/seaweedfs/seaweedfs/commit/b44cf51fe931bd75aa4d37ae766bea90d7f85ccd)\n- [SeaweedFS Pull Request #9929](https://github.com/seaweedfs/seaweedfs/pull/9929)\n- [SeaweedFS Release 4.34](https://github.com/seaweedfs/seaweedfs/releases/tag/4.34)\n- [GitHub Security Advisory GHSA-56wq-x3wv-3ff4](https://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-56wq-x3wv-3ff4)\n- [NVD CVE-2026-55874 Details](https://nvd.nist.gov/vuln/detail/CVE-2026-55874)\n- [CVE.org Record](https://www.cve.org/CVERecord?id=CVE-2026-55874)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-55874) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/f39d221628c93e95f65b186b807e9a92"}, {"timestamp": "2026-09-16T17:16:26Z", "date_only": false, "value": "2026-09-16T17:16:26+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:68333", "record": "RHSA-2026:68333", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-09-16T17:16:26Z", "date_only": false, "value": "2026-09-16T17:16:26+00:00", "kind": "other", "label": "Date", "source": "csaf_redhat \u00b7 RHSA-2026:68333", "record": "RHSA-2026:68333", "field": "vulnerabilities.0.remediations.0.date"}, {"timestamp": "2026-09-16T17:16:26Z", "date_only": false, "value": "2026-09-16T17:16:26+00:00", "kind": "milestone", "label": "Published", "source": "csaf_redhat \u00b7 RHSA-2026:68333", "record": "RHSA-2026:68333", "field": "document.tracking.initial_release_date"}, {"timestamp": "2026-10-26T07:14:42Z", "date_only": false, "value": "2026-10-26T07:14:42+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:68333", "record": "RHSA-2026:68333", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2026-10-26T07:14:42Z", "date_only": false, "value": "2026-10-26T07:14:42+00:00", "kind": "other", "label": "Document generated", "source": "csaf_redhat \u00b7 RHSA-2026:68333", "record": "RHSA-2026:68333", "field": "document.tracking.generator.date"}, {"timestamp": "2026-10-26T07:14:42Z", "date_only": false, "value": "2026-10-26T07:14:42+00:00", "kind": "other", "label": "Updated", "source": "csaf_redhat \u00b7 RHSA-2026:68333", "record": "RHSA-2026:68333", "field": "document.tracking.current_release_date"}]}