CVE-2026-49991

RustFS is a distributed object storage system built in Rust. In 1.0.0-beta.4, authenticated users with only PutObject permission on their own bucket can exploit a path traversal vulnerability in the Snowball auto-extract feature to write arbitrary objects into other users' buckets, completely breaking multi-tenant isolation. The vulnerability chains three flaws: No ../ sanitization in tar entry key normalization; IAM wildcard matching uses raw (uncleaned) paths; and Filesystem path cleaning resolves ../ across bucket boundaries.

• CWE-22
• CWE-862

• https://github.com/rustfs/rustfs/security/advisories/GHSA-f4vq-9ffr-m8m3
• https://github.com/rustfs/rustfs/security/advisories/GHSA-f4vq-9ffr-m8m3

Published

Jun 26, 2026

Last Modified

Jun 29, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-49982tmp is a temporary file and directory creator for node.js. I…8.2
• CVE-2026-49983Deno is a JavaScript, TypeScript, and WebAssembly runtime. P…5.2
• CVE-2026-49984Kestra is an open-source, event-driven orchestration platfor…7.7
• CVE-2026-49987Repomix is a tool that packs repositories into AI-friendly f…7.5
• CVE-2026-49988Repomix is a tool that packs repositories into AI-friendly f…6.8
• CVE-2026-4999A security vulnerability has been detected in z-9527 admin u…6.3
• CVE-2026-49993Nuxt is an open-source web development framework for Vue.js.…5.7
• CVE-2026-49997SurrealDB is a scalable, distributed, collaborative, documen…5.4
• CVE-2026-49998Centrifugo is an open-source scalable real-time messaging se…8.2
• CVE-2026-5000A vulnerability was detected in PromtEngineer localGPT up to…7.3
• CVE-2026-50003A malicious or compromised server can make a DCMTK client us…9.8
• CVE-2026-50005Brickcom cameras ship with default credentials that allows a…8.3