CyberRota Analysis
AI-GeneratedThe RustFS Console versions 0.1.7 to 0.1.10 are vulnerable to stored cross-site scripting (XSS) due to improper handling of HTML content in PDF previews, potentially exposing sensitive administrator credentials such as AccessKeyId, SecretAccessKey, and SessionToken. Organizations using affected versions should prioritize upgrading to version 0.1.10 to mitigate the risk of credential theft and unauthorized access. This critical vulnerability poses a significant threat to the security of systems utilizing the RustFS distributed file system.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
RustFS Console is a web management console for the RustFS distributed file system. From 0.1.7 until 0.1.10, the RustFS Console components/object/preview-modal.tsx and components/object/pdf-viewer.tsx extension-based PDF preview path can render HTML content uploaded as .pdf, allowing stored cross-site scripting in the management console and exposure of administrator AccessKeyId, SecretAccessKey, and SessionToken values. This is caused by a regression of CVE-2026-27822. This vulnerability is fixed in 0.1.10.