CVE-2026-49991CWE-22CWE-862

RustFS Snowball Auto-Extract: Path Traversal allows cross-bucket object injection

High · published June 26, 2026

CVSS v3.1
8.6
EPSS
0%
Percentile
34.7
In the wild
Unconfirmed
What it is

RustFS is a distributed object storage system built in Rust. In 1.0.0-beta.4, authenticated users with only PutObject permission on their own bucket can exploit a path traversal vulnerability in the Snowball auto-extract feature to write arbitrary objects into other users' buckets, completely breaking multi-tenant isolation. The vulnerability chains three flaws: No ../ sanitization in tar entry key normalization; IAM wildcard matching uses raw (uncleaned) paths; and Filesystem path cleaning resolves ../ across bucket boundaries.

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00415 · 34.7th percentile
Weaknesses
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'); CWE-862 · Missing Authorization
Published
2026-06-26T20:01Z
EPSS history
Timeline
  • 26 JUN 20:01Z
    RustFS Snowball Auto-Extract: Path Traversal allows cross-bucket object injection
    cvelistv5