{"action":"Upgrade github.com/seaweedfs/seaweedfs to 0.0.0-20260612000715-b44cf51fe931 or later.","affected":[{"introduced":"0"}],"component":"github.com/seaweedfs/seaweedfs","cve_ids":["CVE-2026-55874"],"ecosystem":"Go","epss":0.00606,"exploited":false,"fixed_versions":["0.0.0-20260612000715-b44cf51fe931"],"ghsa_id":"GHSA-56wq-x3wv-3ff4","id":"tcs_01M5KEXW2TB08DWFVPX5A6RXZB","modified_at":"2026-09-02T19:55:49.122518842Z","published_at":"2026-08-28T22:17:33Z","references":["https://osv.dev/vulnerability/GHSA-56wq-x3wv-3ff4","https://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-56wq-x3wv-3ff4","https://nvd.nist.gov/vuln/detail/CVE-2026-55874","https://github.com/seaweedfs/seaweedfs/pull/9929","https://github.com/seaweedfs/seaweedfs/commit/b44cf51fe931bd75aa4d37ae766bea90d7f85ccd","https://github.com/seaweedfs/seaweedfs","https://github.com/seaweedfs/seaweedfs/releases/tag/4.34"],"severity":{"label":"high","score":7.7},"sources":[{"source":"osv","source_id":"GHSA-56wq-x3wv-3ff4","url":"https://osv.dev/vulnerability/GHSA-56wq-x3wv-3ff4"}],"summary":"SeaweedFS: Path traversal in the S3 gateway X-Amz-Copy-Source header allows cross-bucket object read"}