CVE-2026-62378criticalCWE-79

CVE-2026-62378: falha crítica em rustfs console

RustFS Console: Critical Stored XSS in Preview Modal leading to Administrative Account Takeover

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar console

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9epss 0.4%
RustFS Console is a web management console for the RustFS distributed file system. From 0.1.7 until 0.1.10, the RustFS Console components/object/preview-modal.tsx and components/object/pdf-viewer.tsx extension-based PDF preview path can render HTML content uploaded as .pdf, allowing stored cross-site scripting in the management console and exposure of administrator AccessKeyId, SecretAccessKey, and SessionToken values. This is caused by a regression of CVE-2026-27822. This vulnerability is fixed in 0.1.10.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Produtos afetados
rustfs · console