RustFS is a distributed object storage system built in Rust. Prior to version 1.0.0-alpha.83, a Stored Cross-Site Scripting (XSS) vulnerability in the RustFS Console allows an attacker to execute arbitrary JavaScript in the context of the management console. By bypassing the PDF preview logic, an attacker can steal administrator credentials from `localStorage`, leading to full account takeover and system compromise. Version 1.0.0-alpha.83 fixes the issue.
History

Wed, 25 Feb 2026 15:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:rustfs:rustfs:1.0.0:alpha10:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha11:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha12:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha13:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha14:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha15:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha16:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha17:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha18:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha19:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha1:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha20:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha21:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha22:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha23:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha24:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha25:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha26:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha27:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha28:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha29:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha2:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha30:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha31:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha32:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha33:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha34:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha35:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha36:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha37:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha38:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha39:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha3:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha40:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha41:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha42:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha43:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha44:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha45:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha46:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha47:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha48:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha49:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha4:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha50:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha51:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha52:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha53:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha54:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha55:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha56:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha57:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha58:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha59:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha5:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha60:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha61:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha62:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha63:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha64:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha65:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha66:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha67:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha68:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha69:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha6:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha70:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha71:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha72:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha73:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha74:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha75:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha76:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha77:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha78:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha79:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha7:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha80:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha81:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha82:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha8:*:*:*:rust:*:*
cpe:2.3:a:rustfs:rustfs:1.0.0:alpha9:*:*:*:rust:*:*

Wed, 25 Feb 2026 12:00:00 +0000

Type Values Removed Values Added
First Time appeared Rustfs
Rustfs rustfs
Vendors & Products Rustfs
Rustfs rustfs

Wed, 25 Feb 2026 03:15:00 +0000

Type Values Removed Values Added
Description RustFS is a distributed object storage system built in Rust. Prior to version 1.0.0-alpha.83, a Stored Cross-Site Scripting (XSS) vulnerability in the RustFS Console allows an attacker to execute arbitrary JavaScript in the context of the management console. By bypassing the PDF preview logic, an attacker can steal administrator credentials from `localStorage`, leading to full account takeover and system compromise. Version 1.0.0-alpha.83 fixes the issue.
Title Rust has Critical Stored XSS in Preview Modal, leading to Administrative Account Takeover
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H'}


cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2026-02-25T02:11:57.535Z

Updated: 2026-02-25T19:23:50.704Z

Reserved: 2026-02-24T02:32:39.799Z

Link: CVE-2026-27822

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Analyzed

Published: 2026-02-25T03:16:07.027

Modified: 2026-02-25T15:36:59.633

Link: CVE-2026-27822

cve-icon Redhat

No data.