CVE-2025-68705

Critical

Published: 07/01/2026(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

RustFS versions 1.0.0-alpha.13 to 1.0.0-alpha.78 contain a path traversal vulnerability in the /rustfs/rpc/read_file_stream endpoint. This has been patched in version 1.0.0-alpha.79.

Risk Assessment

Attackers can read arbitrary files on the server, including configuration files or user data, leading to confidentiality breach.

Recommendation

Upgrade RustFS to version 1.0.0-alpha.79 or later. Restrict access to the read_file_stream endpoint.

Original NVD description (English source)

RustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.13 to 1.0.0-alpha.78, RustFS contains a path traversal vulnerability in the /rustfs/rpc/read_file_stream endpoint. This issue has been patched in version 1.0.0-alpha.79.