PT-2026-60228 · Unknown · Rustfs Console

CVE-2026-62378

·

Published

2026-07-15

·

Updated

2026-07-16

CVSS v3.1

9.0

Critical

VectorAV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions RustFS Console versions 0.1.7 through 0.1.9
Description The web management console allows stored cross-site scripting (XSS) because the PDF preview path in components/object/preview-modal.tsx and components/object/pdf-viewer.tsx can render HTML content uploaded with a .pdf extension. This issue can lead to the exposure of administrator AccessKeyId, SecretAccessKey, and SessionToken values.
Recommendations Update to version 0.1.10.

Exploit

Fix

XSS

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-62378
GHSA-7GCX-WG4X-Q9X6

Affected Products

Rustfs Console