What is the CVSS score of CVE-2026-62378?

CVE-2026-62378 has a CVSS 3.1 base score of 9.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of RustFS Console are affected by CVE-2026-62378?

RustFS Console versions 0.1.7-0.1.9 contain a stored cross-site scripting vulnerability that enables credential theft from administrators.. A patch is available.

How to fix or mitigate CVE-2026-62378?

Within 24 hours, identify all deployed RustFS Console instances and their versions; immediately disable file upload and preview functionality for versions 0.1.7-0.1.9. Within 7 days, upgrade all affected instances to version 0.1.10, which contains the security fix. Within 30 days, verify all upgrades are complete, review audit logs for suspicious file activity during the vulnerable period, and rotate administrative credentials as a precaution.

RustFS Console CVE-2026-62378

EUVD-2026-44728 CRITICAL

Cross-site Scripting (XSS) (CWE-79)

2026-07-15 GitHub_M

XSS Rustfs Console

9.0

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.0 CRITICAL

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

9.0 CRITICAL

Requires an authenticated uploader (PR:L) and an admin to open the preview (UI:R); script runs in the console origin stealing admin credentials, causing a scope change (S:C) and full storage compromise.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 15, 2026 - 21:18 EUVD

Source Code Evidence Fetched

Jul 15, 2026 - 17:16 vuln.today

Analysis Generated

Jul 15, 2026 - 17:16 vuln.today

CVE Published

Jul 15, 2026 - 16:50 cve.org

CRITICAL 9.0

DescriptionCVE.org

RustFS Console is a web management console for the RustFS distributed file system. From 0.1.7 until 0.1.10, the RustFS Console components/object/preview-modal.tsx and components/object/pdf-viewer.tsx extension-based PDF preview path can render HTML content uploaded as .pdf, allowing stored cross-site scripting in the management console and exposure of administrator AccessKeyId, SecretAccessKey, and SessionToken values. This is caused by a regression of CVE-2026-27822. This vulnerability is fixed in 0.1.10.

AnalysisAI

Stored cross-site scripting in RustFS Console (0.1.7 through 0.1.9) lets an attacker upload an HTML payload disguised as a .pdf file that executes when an administrator previews it, exfiltrating the console's AccessKeyId, SecretAccessKey, and SessionToken. The flaw is a regression of the previously patched CVE-2026-27822 and stems from the PDF preview path trusting the .pdf filename extension rather than the actual content type. No public exploit identified at time of analysis, but a fix and the vulnerable code are public in 0.1.10.

Technical ContextAI

RustFS is a distributed object-storage file system, and RustFS Console is its React/TypeScript web management UI. The affected code lives in components/object/preview-modal.tsx and components/object/pdf-viewer.tsx. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation): the isPdfPreview() helper decided to render an object in the PDF viewer if the object key merely ended in '.pdf' (keyLower.endsWith('.pdf')), independent of the real MIME type. An attacker could therefore store an object named foo.pdf whose bytes are actually HTML/JavaScript; when the browser rendered it in the preview/iframe context, the script executed in the console's origin. The affected component is identified by CPE cpe:2.3:a:rustfs:console.

RemediationAI

Vendor-released patch: upgrade RustFS Console to v0.1.10, which changes isPdfPreview() to key exclusively on contentType === 'application/pdf' and no longer trusts the .pdf filename extension (commit 49630dc). Reference the advisory at https://github.com/rustfs/rustfs/security/advisories/GHSA-7gcx-wg4x-q9x6 and the release at https://github.com/rustfs/console/releases/tag/v0.1.10. If immediate upgrade is not possible, restrict who can upload objects to trusted operators, avoid using the in-console object preview feature on untrusted or user-supplied objects, and serve stored objects with a correct Content-Type and a restrictive Content-Security-Policy plus Content-Disposition: attachment so browsers download rather than render them; the trade-off is that disabling in-browser preview reduces console usability. Rotating any AccessKeyId/SecretAccessKey/SessionToken values that may have been exposed is advisable if compromise is suspected.