CVE-2026-26187 | treeverse lakeFS up to 1.76.x Local Block Adapter adapter.go strings.HasPrefix path traversal (GHSA-699m-4v95-rmpm)

A vulnerability labeled as critical has been found in treeverse lakeFS up to 1.76.x. This affects the function strings.HasPrefix of the file pkg/block/local/adapter.go of the component Local Block Adapter. The manipulation results in path traversal.

This vulnerability is identified as CVE-2026-26187. The attack can be executed remotely. There is not any exploit available.

The affected component should be upgraded.