GO-2026-4494
NoneCVSS
—
EPSS
—
Published
Feb 17, 2026
CISA due date
—
The record
lakeFS vulnerable to path traversal in local block adapter allow cross-namespace and sibling directory access in github.com/treeverse/lakefs
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/treeverse/lakefs | 0 | 1.77.0 |
Related vulnerabilities
- CVE-2026-26187 lakeFS is an open-source tool that transforms object storage into a Git-like repositories. Same vulnerability
- GO-2026-4321 lakeFS is Missing Timestamp Validation in S3 Gateway Authentication in… Also affects github.com/treeverse/lakefs
- CVE-2025-68671 lakeFS is an open-source tool that transforms object storage into a Git-like repositories. Also affects github.com/treeverse/lakefs
- GO-2025-4090 lakeFS affected by unauthenticated access to API usage metrics in… Also affects github.com/treeverse/lakefs
- CVE-2025-64179 lakeFS is an open-source tool that transforms object storage into a Git-like repositories. Also affects github.com/treeverse/lakefs