lakeFS 在本地块适配器中存在路径遍历漏洞，允许在 github.com/treeverse/lakefs 中跨命名空间和兄弟目录访问

此路径遍历漏洞允许攻击者绕过访问控制机制，访问lakeFS存储中的敏感数据。攻击者可以利用此漏洞读取、修改甚至删除其他命名空间或兄弟目录中的文件，从而造成严重的数据泄露和完整性问题。攻击者可能利用此漏洞获取凭据、窃取商业机密或破坏数据存储。由于lakeFS通常用于存储和管理大规模数据集，因此该漏洞的潜在影响范围非常广泛。

Organizations using lakeFS for data lake management, particularly those with multi-tenant deployments or shared namespaces, are at increased risk. Legacy lakeFS configurations with relaxed access controls are also more vulnerable. Teams relying on lakeFS for sensitive data storage should prioritize patching.

• go / application: Inspect lakeFS configuration files for unusual path entries. Monitor lakeFS logs for suspicious file access attempts, particularly those involving .. sequences.

find /opt/lakefs/ -path "*/..*" -print

• generic web: Monitor access logs for requests containing path traversal sequences (e.g., ../../../../etc/passwd). • generic web: Check response headers for unexpected file disclosures. • generic web: Use curl to probe for directory traversal:

curl -v 'http://your-lakefs-instance/../../../../etc/passwd' 2>&1 | grep 'HTTP/1.1 200 OK'

1. 2026-02-17Disclosure

   disclosure

1. 已保留2026-02-11
2. 发布日期2026-02-17
3. 修改日期2026-02-19
4. EPSS 更新日期2026-03-23

缓解此漏洞的首要措施是立即升级至lakeFS 1.77.0或更高版本。如果无法立即升级，可以考虑实施额外的安全控制措施，例如限制用户访问权限、使用网络防火墙阻止未经授权的访问以及监控系统日志以检测可疑活动。此外，可以配置WAF（Web Application Firewall）来阻止包含恶意路径的请求。升级后，请验证新版本是否已成功部署，并确认路径遍历漏洞已得到修复。