CVE-2026-62378
CriticalCVSS 9.0Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
A stored cross-site scripting vulnerability in the RustFS Console allows an attacker to inject malicious HTML content via a .pdf file. When previewed, this content can expose administrator credentials (AccessKeyId, SecretAccessKey, SessionToken). Affects versions 0.1.7 through 0.1.9 and is a regression of CVE-2026-27822.
Risk Assessment
The risk includes theft of administrator credentials for the RustFS distributed file system, potentially leading to unauthorized access to managed resources and data breaches.
Recommendation
Upgrade RustFS Console to version 0.1.10 or later immediately to remediate the vulnerability.
Original NVD description (English source)
RustFS Console is a web management console for the RustFS distributed file system. From 0.1.7 until 0.1.10, the RustFS Console components/object/preview-modal.tsx and components/object/pdf-viewer.tsx extension-based PDF preview path can render HTML content uploaded as .pdf, allowing stored cross-site scripting in the management console and exposure of administrator AccessKeyId, SecretAccessKey, and SessionToken values. This is caused by a regression of CVE-2026-27822. This vulnerability is fixed in 0.1.10.