5.4

CVE-2026-27822

Exploit

Rust has Critical Stored XSS in Preview Modal, leading to Administrative Account Takeover

RustFS is a distributed object storage system built in Rust. Prior to version 1.0.0-alpha.83, a Stored Cross-Site Scripting (XSS) vulnerability in the RustFS Console allows an attacker to execute arbitrary JavaScript in the context of the management console. By bypassing the PDF preview logic, an attacker can steal administrator credentials from `localStorage`, leading to full account takeover and system compromise. Version 1.0.0-alpha.83 fixes the issue.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Rustfs ≫ Rustfs Version 1.0.0 Update alpha1 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha10 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha11 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha12 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha13 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha14 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha15 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha16 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha17 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha18 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha19 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha2 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha20 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha21 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha22 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha23 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha24 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha25 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha26 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha27 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha28 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha29 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha3 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha30 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha31 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha32 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha33 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha34 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha35 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha36 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha37 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha38 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha39 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha4 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha40 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha41 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha42 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha43 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha44 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha45 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha46 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha47 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha48 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha49 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha5 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha50 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha51 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha52 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha53 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha54 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha55 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha56 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha57 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha58 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha59 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha6 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha60 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha61 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha62 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha63 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha64 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha65 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha66 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha67 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha68 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha69 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha7 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha70 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha71 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha72 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha73 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha74 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha75 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha76 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha77 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha78 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha79 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha8 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha80 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha81 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha82 SwPlatform rust
Rustfs ≫ Rustfs Version 1.0.0 Update alpha9 SwPlatform rust
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 4.22% 0.899
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 5.4 2.3 2.7
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
security-advisories@github.com 9 2.3 6
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

https://github.com/rustfs/rustfs/security/advisories/GHSA-v9fg-3cr2-277j
Vendor Advisory
Exploit