{"action":"Upgrade github.com/seaweedfs/seaweedfs to 0.0.0-20260612000715-b44cf51fe931 or later.","affected":[{"introduced":"0"}],"component":"github.com/seaweedfs/seaweedfs","cve_ids":["CVE-2026-55874"],"ecosystem":"Go","epss":0.00606,"exploited":false,"fixed_versions":["0.0.0-20260612000715-b44cf51fe931"],"ghsa_id":"GHSA-56wq-x3wv-3ff4","id":"tcs_01M5KGT8E4BGQF2VSHGVD45PWP","modified_at":"2026-09-02T19:55:49.122518842Z","published_at":"2026-09-02T18:37:27Z","references":["https://osv.dev/vulnerability/GO-2026-6327","https://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-56wq-x3wv-3ff4","https://nvd.nist.gov/vuln/detail/CVE-2026-55874","https://github.com/seaweedfs/seaweedfs/commit/b44cf51fe931bd75aa4d37ae766bea90d7f85ccd","https://github.com/seaweedfs/seaweedfs/pull/9929","https://github.com/seaweedfs/seaweedfs/releases/tag/4.34"],"severity":{"label":"high","score":7.7},"sources":[{"source":"osv","source_id":"GO-2026-6327","url":"https://osv.dev/vulnerability/GO-2026-6327"},{"source":"nvd","source_id":"CVE-2026-55874","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55874"}],"summary":"SeaweedFS: Path traversal in the S3 gateway X-Amz-Copy-Source header allows cross-bucket object read in github.com/seaweedfs/seaweedfs"}