CVE-2026-27607

Опубликовано: 25 фев. 2026

Источник: nvd

CVSS3: 8.1

CVSS3: 9.1

EPSS Низкий

Описание

RustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.56 through 1.0.0-alpha.82, RustFS does not validate policy conditions in presigned POST uploads (PostObject), allowing attackers to bypass content-length-range, starts-with, and Content-Type constraints. This enables unauthorized file uploads exceeding size limits, uploads to arbitrary object keys, and content-type spoofing, potentially leading to storage exhaustion, unauthorized data access, and security bypasses. Version 1.0.0-alpha.83 fixes the issue.

Ссылки

https://github.com/rustfs/rustfs/security/advisories/GHSA-w5fh-f8xh-5x3p
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:rustfs:rustfs:1.0.0:alpha56:*:*:*:rust:*:*

cpe:2.3:a:rustfs:rustfs:1.0.0:alpha57:*:*:*:rust:*:*

cpe:2.3:a:rustfs:rustfs:1.0.0:alpha58:*:*:*:rust:*:*

cpe:2.3:a:rustfs:rustfs:1.0.0:alpha59:*:*:*:rust:*:*

cpe:2.3:a:rustfs:rustfs:1.0.0:alpha60:*:*:*:rust:*:*

cpe:2.3:a:rustfs:rustfs:1.0.0:alpha61:*:*:*:rust:*:*

cpe:2.3:a:rustfs:rustfs:1.0.0:alpha62:*:*:*:rust:*:*

cpe:2.3:a:rustfs:rustfs:1.0.0:alpha63:*:*:*:rust:*:*

cpe:2.3:a:rustfs:rustfs:1.0.0:alpha64:*:*:*:rust:*:*

cpe:2.3:a:rustfs:rustfs:1.0.0:alpha65:*:*:*:rust:*:*

cpe:2.3:a:rustfs:rustfs:1.0.0:alpha66:*:*:*:rust:*:*

cpe:2.3:a:rustfs:rustfs:1.0.0:alpha67:*:*:*:rust:*:*

cpe:2.3:a:rustfs:rustfs:1.0.0:alpha68:*:*:*:rust:*:*

cpe:2.3:a:rustfs:rustfs:1.0.0:alpha69:*:*:*:rust:*:*

cpe:2.3:a:rustfs:rustfs:1.0.0:alpha70:*:*:*:rust:*:*

cpe:2.3:a:rustfs:rustfs:1.0.0:alpha71:*:*:*:rust:*:*

cpe:2.3:a:rustfs:rustfs:1.0.0:alpha72:*:*:*:rust:*:*

cpe:2.3:a:rustfs:rustfs:1.0.0:alpha73:*:*:*:rust:*:*

cpe:2.3:a:rustfs:rustfs:1.0.0:alpha74:*:*:*:rust:*:*

cpe:2.3:a:rustfs:rustfs:1.0.0:alpha75:*:*:*:rust:*:*

cpe:2.3:a:rustfs:rustfs:1.0.0:alpha76:*:*:*:rust:*:*

cpe:2.3:a:rustfs:rustfs:1.0.0:alpha77:*:*:*:rust:*:*

cpe:2.3:a:rustfs:rustfs:1.0.0:alpha78:*:*:*:rust:*:*

cpe:2.3:a:rustfs:rustfs:1.0.0:alpha79:*:*:*:rust:*:*

cpe:2.3:a:rustfs:rustfs:1.0.0:alpha80:*:*:*:rust:*:*

cpe:2.3:a:rustfs:rustfs:1.0.0:alpha81:*:*:*:rust:*:*

cpe:2.3:a:rustfs:rustfs:1.0.0:alpha82:*:*:*:rust:*:*

EPSS

Процентиль: 18%

0.00265

Низкий

8.1 High

CVSS3

9.1 Critical

CVSS3

Дефекты

CWE-20

CWE-863

Связанные уязвимости

GHSA-w5fh-f8xh-5x3p

CVSS3: 8.1

github

6 месяцев назад

RustFS: Missing Post Policy Validation leads to Arbitrary Object Write

BDU:2026-05083

CVSS3: 9.1

fstec

6 месяцев назад

Уязвимость распределенной системы хранения данных RustFS, связанная с недостаточной проверкой вводимых данных, позволяющая нарушителю оказать воздействие на целостность и доступность защищаемой информации

EPSS

Процентиль: 18%

0.00265

Низкий

8.1 High

CVSS3

9.1 Critical

CVSS3

Дефекты

CWE-20

CWE-863