CVE-2026-77763

MediumCVSS 6.5

Published: 21/08/2026(UTC)Updated: 21/08/2026(UTC)Translated: 21/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.33%

26th percentile - higher than 26% of all known CVEs

Summary

The filestore backend in pkg/object/file.go, used for file:// stores and as a common juicefs sync destination, derives every operation's target from path(key) without checking that the result stays within the root. Object keys from an external store can contain traversal segments, allowing writes outside the intended local directory with no error. An operator syncing from a not fully controlled bucket is exposed to file writes at attacker-influenced locations.

Risk Assessment

Risk of writing malicious files outside the intended directory, potentially leading to overwriting critical system files or injecting malicious code.

Recommendation

Upgrade juicefs to a patched version that rejects keys escaping the root, and avoid syncing from untrusted sources.

Other vulnerabilities in juicefs

CVE-2026-59092High
JuiceFS up to version 1.3.1 contains an authentication bypass vulnerability. An unauthenticated remote attacker can access sensitive debug and metrics endpoints by exploiting improper handler registration on the shared http.DefaultServeMux. The attacker can retrieve the process command line containing metadata engine connection strings with database credentials, gaining full read/write access to the filesystem metadata.

Original NVD description (English source)

The filestore backend in pkg/object/file.go, used for file:// stores and as a common juicefs sync destination, derived every operation's target from path(key), which returned either filepath.Join(d.root, key) or filepath.Clean(d.root + key) with no check that the result stayed beneath the root. Put, Get, Head, Delete, Chmod, Chown, Symlink and Readlink all consumed that value directly. Object keys enumerated from a source object store during a sync are not constrained the way local filesystem names are, so a key containing traversal segments causes juicefs to write attacker-supplied content to a path outside the intended local destination, and no error is returned. An operator syncing from a bucket whose contents they do not fully control, such as a shared or public bucket or one an attacker can write to, is therefore exposed to a file write at an attacker-influenced location. The fix changes path() to return an error and rejects any key whose resolved path escapes the root.