Affected by GO-2023-2012
and 8 other vulnerabilities
GO-2023-2012: lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs
GO-2023-2397: User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs
GO-2023-2398: lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs
GO-2024-2581: User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs
GO-2024-3291: Re-creating a deleted user in lakeFS will re-enable previous user credentials that existed prior to its deletion in github.com/treeverse/lakefs
GO-2025-3479: lakeFS allows an authenticated user to cause a crash by exhausting server memory in github.com/treeverse/lakefs
GO-2025-4090: lakeFS affected by unauthenticated access to API usage metrics in github.com/treeverse/lakefs
GO-2026-4321: lakeFS is Missing Timestamp Validation in S3 Gateway Authentication in github.com/treeverse/lakefs
GO-2026-4494: lakeFS vulnerable to path traversal in local block adapter allow cross-namespace and sibling directory access in github.com/treeverse/lakefs
type URI struct {
// Repository is the name of the repository being addressed Repository string// Ref represents the reference in the repository (commit, tag, branch, etc.) Ref string// Path is a path to an object (or prefix of such) in lakeFS. It *could* be null since there's a difference between// an empty path ("lakefs://repo/branch/", and no path at all e.g. "lakefs://repo/branch").// Since path is the only URI part that is allowed to be empty, it is represented as a pointer.
Path *string
}
Affected by 
Documentation
¶
Source Files