CVE-2026-62378
Last modified
CVE-2026-62378 is a critical-severity vulnerability rated 9/10 on the CVSS scale. RustFS Console is a web management console for the RustFS distributed file system. From 0.1.7 until 0.1.10, the RustFS Console components/object/preview-modal.tsx and components/object/pdf-viewer.tsx extension-based PDF preview path can render HTML content uploaded as .pdf, allowing stored cross-site scripting in the management console and exposure of administrator AccessKeyId, SecretAccessKey, and SessionToken values. EPSS estimates a 0.33% chance of exploitation in the next 30 days.
Description
RustFS Console is a web management console for the RustFS distributed file system. From 0.1.7 until 0.1.10, the RustFS Console components/object/preview-modal.tsx and components/object/pdf-viewer.tsx extension-based PDF preview path can render HTML content uploaded as .pdf, allowing stored cross-site scripting in the management console and exposure of administrator AccessKeyId, SecretAccessKey, and SessionToken values. This is caused by a regression of CVE-2026-27822. This vulnerability is fixed in 0.1.10.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| rustfs | console | >= 0.1.7, < 0.1.10 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-62378?
How severe is CVE-2026-62378?
How do I fix CVE-2026-62378?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-62368Snipe-IT is an IT asset/license management system. Prior to …8.1
- CVE-2026-62369KubeEdge is an open source system for extending native conta…8.1
- CVE-2026-6237The Quick Table plugin for WordPress is vulnerable to Stored…6.4
- CVE-2026-62370KubeEdge is an open source system for extending native conta…6.5
- CVE-2026-62371KubeEdge is an open source system for extending native conta…8.8
- CVE-2026-62377libheif is a HEIF and AVIF file format decoder and encoder. …4.3
- CVE-2026-62379Open Access Management (OpenAM) is an access management solu…9.8
- CVE-2026-6238The deprecated functions ns_printrrf, ns_printrr and fp_nque…6.5
- CVE-2026-62380Netty (io.netty:netty-codec-socks) versions 4.2.0.Final thro…7.5
- CVE-2026-62381luci-lib-px5g (LuCI) contains a heap-based buffer overflow i…6.6
- CVE-2026-62382PasswordPusher versions v1.45.11 through v2.9.5 contain an i…6.9
- CVE-2026-62383nltk versions before 3.10.2 contain a symlink-based arbitrar…5.5
Are you affected by CVE-2026-62378?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST