CVE-2026-27822

The record

RustFS is a distributed object storage system built in Rust. Prior to version 1.0.0-alpha.83, a Stored Cross-Site Scripting (XSS) vulnerability in the RustFS Console allows an attacker to execute arbitrary JavaScript in the context of the management console. By bypassing the PDF preview logic, an attacker can steal administrator credentials from `localStorage`, leading to full account takeover and system compromise. Version 1.0.0-alpha.83 fixes the issue.

Affected packages

Related vulnerabilities

• GHSA-v9fg-3cr2-277j Rust has Critical Stored XSS in Preview Modal, leading to Administrative Account Takeover Same vulnerability
• GHSA-mm2q-qcmx-gw4w RustFS: ListServiceAccount authorizes against wrong admin action, enabling cross-user… Also affects rustfs
• CVE-2026-40937 RustFS is a distributed object storage system built in Rust. Also affects rustfs
• GHSA-pfcq-4gjr-6gjm RustFS: Missing admin authorization on notification target endpoints allows… Also affects rustfs
• GHSA-mx42-j6wv-px98 RustFS has an authorization bypass in multipart UploadPartCopy enables cross-bucket… Also affects rustfs
• CVE-2026-39360 RustFS is a distributed object storage system built in Rust. Also affects rustfs
• GHSA-w5fh-f8xh-5x3p RustFS: Missing Post Policy Validation leads to Arbitrary Object Write Also affects rustfs
• CVE-2026-27607 RustFS is a distributed object storage system built in Rust. Also affects rustfs