CVE-2026-27607CWE-20CWE-863

RustFS's Missing Post Policy Validation leads to Arbitrary Object Write

High · published February 25, 2026

CVSS v3.1
8.1
EPSS
0%
Percentile
38.5
In the wild
Unconfirmed
What it is

RustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.56 through 1.0.0-alpha.82, RustFS does not validate policy conditions in presigned POST uploads (PostObject), allowing attackers to bypass content-length-range, starts-with, and Content-Type constraints. This enables unauthorized file uploads exceeding size limits, uploads to arbitrary object keys, and content-type spoofing, potentially leading to storage exhaustion, unauthorized data access, and security bypasses. Version 1.0.0-alpha.83 fixes the issue.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00454 · 38.5th percentile
Weaknesses
CWE-20 · Improper Input Validation; CWE-863 · Incorrect Authorization
Published
2026-02-25T02:10Z
EPSS history
Timeline
  • 25 FEB 02:10Z
    RustFS's Missing Post Policy Validation leads to Arbitrary Object Write
    cvelistv5